is incorrect. Requirements of the project is being defined after conducting feasibility
study.

is incorrect. While the risks may eventually be added to the register, the best answer is
to first add them to the watchlist for monitoring.

The three lines of defense model is a framework that defines the roles and responsibilities of different functions in an organization for managing risks and ensuring effective internal control1. The three lines of defense are:
* The first line of defense: the operational management and staff who are responsible for implementing
* and maintaining the internal control system and managing the risks within their areas of activity
* The second line of defense: the oversight functions, such as risk management, compliance, and quality assurance, who provide guidance, support, and monitoring to the first line of defense and ensure that the internal control system is designed and operating effectively
* The third line of defense: the internal audit function, who provides independent and objective assurance to the board and senior management on the adequacy and effectiveness of the internal control system and the performance of the first and second lines of defense2 The three lines of defense model facilitates a completely independent review of test results for evaluating control effectiveness, because it ensures that the internal audit function, as the third line of defense, has the authority, independence, and competence to conduct objective and unbiased assessments of the internal control system and report its findings and recommendations to the board and senior management3. The internal audit function can also use the test results from the first and second lines of defense as inputs for its own audit planning and testing, and verify their validity and reliability4.
References = The Three Lines of Defense in Effective Risk Management and Control - IIA, The Three Lines Model - IIA, The Role of Internal Audit in the Three Lines of Defense - IIA, Evaluating and Improving Internal Control in Organizations - IFAC

According to the CRISC Review Manual, notifying network administrators before testing is the best mitigating control to reduce the risk introduced when conducting penetration tests, because it helps to avoid any disruption or damage to the network services and systems. Penetration testing is a technique that simulates an attack on the network to identify and exploit the vulnerabilities and weaknesses. Notifying network administrators before testing allows them to prepare for the test, monitor the test activities, and respond to any incidents or issues that may arise during the test. The other options are not the best mitigating controls, because they do not address the risk of network disruption or damage. Requiring the vendor to sign a nondisclosure agreement is a legal measure that protects the confidentiality of the network information, but it does not prevent the vendor from causing any harm to the network. Clearly defining the project scope is a planning activity that sets the boundaries and objectives of the test, but it does not ensure the safety and availability of the network. Performing background checks on the vendor is a due diligence activity that verifies the vendor's credentials and reputation, but it does not guarantee the vendor's performance or behavior. References = CRISC Review Manual, 7th Edition, Chapter 4, Section 4.2.2, page 181.