A.consistently throughout the enterprise.

B.as part of the security business case.

C.in response to the threat landscape.

D.during a root cause analysis.

A.They are approved by the IT governance function

B.They are identified using global security frameworks and standards

C.They are clear and can be understood by stakeholders

D.They are regularly reassessed and reported to stakeholders

A.Report the findings to senior management.

B.Identify mitigating controls.

C.Assign risk ownership.

D.Prioritize the risks.

A.Vulnerabilities were caused by insufficient user acceptance testing (UAT).

B.Exploit code for one of the vulnerabilities is publicly available.

C.Atules of engagement form was not signed prior to the penetration test.

D.Vulnerabilities were not found by internal tests.

A.Conduct interviews with organizational units.

B.Establish incident key performance indicators (KPIs).

C.Participate in emergency response activities.

D.Perform post-incident reviews.