Explanation/Reference:
Explanation:
As preventive control and prevention is preferred over detection and recovery, therefore, private and key- based encryption should be adopted for managing risks.
Incorrect Answers:
A, C, D: As explained in above section preventive control and prevention is preferred over detection and recovery, hence these are less preferred way.

Section: Volume A
Explanation:
The risk components defined by the COSO ERM are internal environment, objective settings, event identification, risk assessment, risk response, control objectives, information and communication, and monitoring.
Incorrect Answers:
C: Business continuity is not considered as risk component within the ERM framework.

Explanation/Reference:
Explanation:
Risk probability and assessment is completed through interviews and meetings with the participants that are most familiar with the risk events, the project work, or have other information that can help determine the affect of the risk.
Incorrect Answers:
B: The true cost of the risk event is not a qualitative risk assessment approach. It is often done during the quantitative risk analysis process.
C: The probability and impact matrix is a tool and technique to prioritize the risk events, but it's not the best answer for assessing risk events within the project.
D: Root cause analysis is a risk identification technique, not a qualitative assessment tool.

Section: Volume D
Explanation/Reference: https://m.isaca.org/Certification/CRISC-Certified-in-Risk-and-Information-Systems-Control/ Documents/CRISC-Additional-Verification-Form-2015-Later-frm_Eng_0818.pdf