Which two would need to happen in order for Advanced Access Controls (AAC) to automatically assign a status of "Closed" to an access incident? (Choose two.)

You have created a risk definition R100 and have created a new control C100 for this risk. No user has been assigned the Risk or Control reviewer and approver roles. What will be the state of R100 and C100 after submitting?

You are advising your client on design and configuration related to how access incident results will be viewed and managed. The client has provided a list of business requirements:
* Incident results can be viewed by Department
* Groups of investigators receive assigned incidents based on Department
* Must ensure systematically that no incident is unassigned to an investigator Which three must be configured to support these requirements? (Choose three.)

You are implementing Advanced AccessControls and there is a requirement for a control to monitor user access to specific, client-defined access points which give users the ability to both initiate a purchase order and approve payments on that purchase order.
Which is a valid option to implement the control?

What would happen to an access incident in Advanced Access Controls (AAC) that has been remediated and has a status of "Closed," but poses a conflict again during a subsequent evaluation of controls?