Section: Volume C
Explanation/Reference:
Explanation:
As business case includes business need (like new product, change in process, compliance need, etc.) and the requirements of the enterprise (new technology, cost, etc.), risk professional should utilize this for implementing specific risk mitigation activity. Risk professional must look at the costs of the various controls and compare them against the benefits that the organization will receive from the risk response. Hence he/she needs to have knowledge of business case development to illustrate the costs and benefits of the risk response.
Incorrect Answers:
A, C, D: These all options are supplemental.

is incorrect. Notification of failure does not determine control strength, hence this option
is not correct.

is incorrect. Tying access requests to user accounts confirms that all access requests have been processed; however, the test does not consider user accounts that have been established without the supporting access request. Answer:A is incorrect. Tying user accounts to human resources (HR) records confirms whether user accounts are uniquely tied to employees, not accounts for the effectiveness of the system access management process. Answer:C is incorrect. Tying vendor records to user accounts may confirm valid accounts on an ecommerce application, but it does not consider user accounts that have been established without the supporting access request.

Section: Volume D

Section: Volume A
Explanation:
As regular audits can spot gaps in information security compliance, periodic audits can ensure that outsourced service provider comply with the enterprise's information security policy.
Incorrect Answers:
A: Penetration testing can identify security vulnerability, but cannot ensure information compliance.
B: Service level monitoring can only identify operational issues in the enterprise's operational environment. It does not play any role in ensuring that outsourced service provider complies with the enterprise's information security policy.
C: Training can increase user awareness of the information security policy, but is less effective than periodic auditing.