is incorrect. Challenge response system is used to verify the user's identification but does not completely address the issue of access risk if access was not appropriately designed in the first place. Answer:B is incorrect. Forcing users to change their passwords does not ensure that access control is appropriately assigned. Answer:A is incorrect. Monitoring and recording unsuccessful logon attempts does not address the risk of appropriate access rights. In other words, it does not prevent unauthorized access.

Section: Volume C
Explanation:
Key Risk Indicators are the prime monitoring indicators of the enterprise. KRIs are highly relevant and possess a high probability of predicting or indicating important risk. KRIs help in avoiding excessively large number of risk indicators to manage and report that a large enterprise may have.
Incorrect Answers:
B: Lag indicators are the risk indicators that is used to indicate risk after events have occurred.
C: Lead indicators are the risk indicators that is used to indicate which capabilities are in place to prevent events from occurring.
D: Risk indicators are metrics used to indicate risk thresholds, i.e., it gives indication when a risk level is approaching a high or unacceptable level of risk. The main objective of a risk indicator is to ensure tracking and reporting mechanisms that alert staff about the potential risks.

Explanation/Reference:
Explanation:
They are monitored on regular basis as they indicate high probability and high impact risks. As risks change over time, hence KRIs should also be monitored regularly for its effectiveness on these changing risks.
Incorrect Answers:
A, B, C: These all are true for KRIs. Key Risk Indicators are the prime monitoring indicators of the enterprise. KRIs are highly relevant and possess a high probability of predicting or indicating important risk.
KRIs help in avoiding excessively large number of risk indicators to manage and report that a large enterprise may have.
The complete set of KRIs should also balance indicators for risk, root causes and business impact, so as to indicate the risk and its impact completely.