Section: Volume D
Explanation/Reference:

The risk appetite of an organization is the amount and type of risk that it is willing to accept in pursuit of its objectives1. Technology risk is the risk related to the use of information and technology in the organization2.
If an organization has raised its risk appetite for technology risk, it means that it is willing to accept more risk in exchange for more potential benefits from technology initiatives. This would likely result in lower risk management cost, as the organization would spend less on implementing and maintaining controls to mitigate technology risk. The other options are not the most likely results of raising the risk appetite for technology risk. Increased inherent risk is the risk before considering the effect of controls3, and it is not directly affected by the risk appetite. Higher risk management cost would be the opposite of the expected outcome, as the organization would reduce its risk management efforts. Decreased residual risk is the risk after considering the effect of controls3, and it would also be the opposite of the expected outcome, as the organization would accept more risk exposure. References = Organisations must define their IT risk appetite and tolerance; IT Risk Resources; CRISC | What Accurate CRISC Free Download Is

Explanation/Reference:
Explanation:
When the risk level is less than risk tolerance level of the enterprise than no action is taken against that, because the cost of mitigation will increase over its benefits.
Incorrect Answers:
A: This is not a valid answer, as no response is being applied to such low risk level.
B: Risk register is updates after applying response, and as no response is applied to such low risk level; hence no updating is done.
D: This is not a valid answer, as no response is being applied to such low risk level.

Explanation/Reference:
Explanation:
Data owners are responsible for assigning user entitlement changes and approving access to the systems for which they are responsible.
Incorrect Answers:
B, C, D: Data owners are not responsible for intrusion detection, platform security or antivirus controls.
These are the responsibilities of data custodians.