A.Number of encrypted customer databases

B.Number of databases that host customer data

C.Number of customer records held

D.Number of staff members having access to customer data

A.Reduction in the frequency of a threat

B.Minimization of inherent risk

C.Reduction in the impact of a threat

D.Minimization of residual risk

E.Explanation:
The inherent risk of a process is a given and cannot be affected by risk reduction or risk mitigation
efforts. Hence it should be reduced as far as possible.

F.is incorrect. The objective of risk reduction is to reduce the residual risk to levels below
the enterprise's risk tolerance level.

G.is incorrect. Risk reduction efforts can focus on either avoiding the frequency of the risk
or reducing the impact of a risk.

A.enterprise risk profile

B.priority in the risk register

C.appropriate level of protection

D.business process owner

A.low risk tolerance.

B.corporate culture alignment.

C.high risk tolerance

D.corporate culture misalignment.

A.Conduct risk assessment peer reviews.

B.Determine and understand the risk rating of scenarios.

C.Identify roles and responsibilities for security controls.

D.Engage a third party to perform a risk assessment.