is incorrect. Risk avoidance means to evade risk altogether, eliminate the cause of the risk event, or change the project plan to protect the project objectives from the risk event. Risk avoidance is applied when the level of risk, even after the applying controls, would be greater than the risk tolerance level of the enterprise. Answer: D is incorrect. Risk acceptance means that no action is taken relative to a particular risk; loss is accepted if it occurs. Answer: C is incorrect. Risk mitigation attempts to reduce the probability of a risk event and its impacts to an acceptable level. Risk mitigation can utilize various forms of control carefully integrated together.

Explanation/Reference:
Explanation:
As new threats are identified and prioritized in terms of impact, the first step is to evaluate the ability of existing controls to mitigate risk associated with new threats and if it does not work then in that case facilitate the:
Modification of the technical architecture

Deployment of a threat-specific countermeasure

Implementation of a compensating mechanism or process until mitigating controls are developed

Education of staff or business partners

Incorrect Answers:
D: Applying more controls is not the good solution. They usually complicate the condition.

is incorrect. : These controls make efforts to overcome the impact of the incident on the
business, hence IDS is not a recovery control.