A qualitative risk analysis assigns descriptive ratings such as high, medium, or low to risks based on their likelihood and impact without numerical calculations.
Including MTTR/MTBF (A) and ALE/ARO (D) are quantitative methods using metrics. Risk registers (B) document risks but don't specify analysis type.
Qualitative and quantitative risk methods are fundamental in SY0-701 risk management [6:Chapter 17 CompTIA Security+ Study Guide].

Due diligence refers to the process of researching and understanding the laws, regulations, and best practices that govern information security within a specific industry. Organizations are required to conduct due diligence to ensure compliance with legal and regulatory requirements, which helps mitigate risks and avoid penalties.
Compliance reporting involves generating reports to demonstrate adherence to legal or regulatory standards.
GDPR is a specific regulation governing data privacy in the EU, not a general practice of researching laws.
Attestation is a formal declaration that an organization is compliant with a set of standards but is not the act of researching the laws.

If email filtering tools are not tuned based on reported emails, malicious emails will continue to bypass filters. Effective filtering depends on feedback and updating rules with real threat data.
Flagging legitimate emails (A) would cause false positives, shadow IT (C) and forwarding personal emails (D) are less relevant to the filtering bypass.
Tuning email filters is part of continuous Security Operations processes#6:Chapter 14 CompTIA Security+ Study Guide#.

Software as a Service (SaaS) is the cloud model that best meets the goal of outsourcing the management, including patching, of firmware, operating systems, and applications to the cloud vendor. In a SaaS environment, the cloud provider is responsible for maintaining and updating the entire software stack, allowing the organization to focus on using the software rather than managing its infrastructure.
Reference = CompTIA Security+ SY0-701 study materials, particularly the domains related to cloud security models.