Section: Volume B
Explanation:
Security log monitoring, Post-implementation reviews of program changes, and Problem management provide indirect information. Security log monitoring provide indirect information about certain controls in the security environment, particularly when used to analyze the source of failed access attempts.
Post-implementation reviews of program changes provide indirect information about the effectiveness of internal controls over the development process.
Problem management provide indirect information about the effectiveness of several different IS processes that may ultimately be determined to be the source of incidents.
Incorrect Answers:
D: Recovery testing is the direct evidence that the redundancy or backup controls work effectively. It doesn't provide any indirect information.

Section: Volume B
Explanation:
Catastrophic risk causes critical financial losses that have the possibility of bankruptcy.
Incorrect Answers:
A: Marginal risk causes financial loss in a single line of business and a reduced return on IT investment.
B: It causes minimal impact on a single line of business affecting their ability to deliver services or products.
C: Critical risk causes serious financial losses in more than one line of business with a loss in productivity.

Section: Volume D