is incorrect. Communications management is the execution of the communications management plan. Answer:D is incorrect. The project change control process not valid as it's the parent of the integrated change control process, which is more accurate for this option A is incorrect. Configuration management is the documentation and control of the product's features and functions.

Explanation/Reference:
Explanation:
The Management class of controls includes five families. These families include over 40 individual controls.
Following is a list of each of the families in the Management class:
Certification, Accreditation, and Security Assessment (CA): This family of controls addresses steps to

implement a security and assessment program. It includes controls to ensure only authorized systems are allowed on a network. It includes details on important security concepts, such as continuous monitoring and a plan of action and milestones.
Planning (PL): The PL family focuses on security plans for systems. It also covers Rules of Behaviour

for users. Rules of Behaviour are also called an acceptable use policy.
Risk Assessment (RA): This family of controls provides details on risk assessments and vulnerability

scanning.
System and Services Acquisition (SA): The SA family includes any controls related to the purchase of

products and services. It also includes controls related to software usage and user installed software.
Program Management (PM): This family is driven by the Federal Information Security Management Act

(FISMA). It provides controls to ensure compliance with FISMA. These controls complement other controls. They don't replace them.
Incorrect Answers:
B, D: Identification and authentication, and audit and accountability control are technical class of controls.

Explanation/Reference:
Explanation:
As the risk is transferred to the third party (electrician), hence this type of risk response is transference.
Incorrect Answers:
A: Risk avoidance means to evade risk altogether, eliminate the cause of the risk event, or change the project plan to protect the project objectives from the risk event. Risk avoidance is applied when the level of risk, even after the applying controls, would be greater than the risk tolerance level of the enterprise.
C: Risk mitigation attempts to reduce the probability of a risk event and its impacts to an acceptable level.
Risk mitigation can utilize various forms of control carefully integrated together.
D: Risk acceptance means that no action is taken relative to a particular risk; loss is accepted if it occurs.

Section: Volume D
Explanation/Reference: