Explanation
According to the ServiceNow Hardware Asset Management documentation, the Now Platform can create an asset automatically under the following conditions1:
Configuration normalization: When a configuration item (CI) is normalized, the platform creates a corresponding asset if it does not exist.
Enforced CI verification: When an asset is verified, the platform creates a corresponding CI if it does not exist.
Data synching: When an asset or a CI is updated, the platform synchronizes the data between the two records.
Model characterization: When a model is characterized, the platform creates an asset for each CI that belongs to that model.
Data justification is not a condition that triggers automatic asset creation. Data justification is a process of validating and correcting the data quality of assets and CIs2. References:
ServiceNow Hardware Asset Management: Asset and CI management
ServiceNow Hardware Asset Management: Data justification

According to the ServiceNow Hardware Asset Management documentation, advanced risk assessment is a process of identifying, analyzing, and evaluating the risks associated with hardware assets and configuration items (CIs) in the configuration management database (CMDB)1. Advanced risk assessment uses the Advanced Risk Assessment engine, which is built to address risk through an integrated risk framework2. The advanced risk assessment process consists of the following steps1:
* Create a risk assessment scope: This step defines the scope and criteria of the data to be assessed, such as the asset class, category, or attribute. The risk assessment scope also specifies the frequency and duration of the assessment.
* Create a risk assessment schedule: This step determines when and how often the assessment runs, based on the risk assessment scope. The risk assessment schedule also defines the assessment owner, who is responsible for overseeing the assessment process and approving the results.
* Assign the assessment tasks: This step assigns the assessment tasks to the appropriate assessors, who are the users or groups who have the knowledge and authority to evaluate and update the data. The assessment tasks can be assigned manually or automatically, based on predefined rules or workflows.
* Run the assessment: This step executes the assessment process, which involves sending notifications and reminders to the assessors, displaying the data to be assessed in a user-friendly interface, allowing the assessors to review and modify the data, and tracking the progress and status of the assessment tasks.
* Review the assessment results: This step allows the assessment owner to verify and approve the results of the assessment, before applying the changes to the CMDB. The assessment owner can also view the risk scores, risk indicators, and risk heat maps of the assessed data.
* Handle the risk response: This step involves creating and managing risk response tasks to address the identified risks. Risk response tasks are records that track the actions taken to mitigate, transfer, avoid, or accept the risks. Risk response tasks can be created manually by the assessment owner or automatically by the system based on predefined rules or workflows.
For advanced risk assessment, risk response can be handled in the following ways:
* Create multiple risk response tasks: This option allows the assessment owner to create more than one risk response task for each assessed data, depending on the complexity and severity of the risk. For example, the assessment owner can create a mitigation task to reduce the impact or likelihood of the risk, and a transfer task to shift the responsibility or ownership of the risk to another party3.
* Create at least one risk response task: This option requires the assessment owner to create at least one risk response task for each assessed data, regardless of the complexity and severity of the risk. This ensures that every risk is addressed and documented in the system3.
The other options are not correct because:
* Skipped entirely based on attributes defined in the RAM: This option is not a valid way to handle risk response for advanced risk assessment. The RAM (Risk Assessment Matrix) is a tool that helps to calculate the risk score and risk indicator of the assessed data, based on the impact and likelihood attributes defined in the risk assessment scope1. The RAM does not determine whether to skip the risk response or not.
* Must create a mitigation response task: This option is not a mandatory way to handle risk response for advanced risk assessment. A mitigation response task is one of the possible types of risk response tasks, but not the only one. Depending on the risk appetite and strategy of the organization, the assessment owner can choose other types of risk response tasks, such as transfer, avoid, or accept3.
References:
* ServiceNow Hardware Asset Management: Advanced Risk Assessment
* ServiceNow Hardware Asset Management: Risk response tasks
* ServiceNow Hardware Asset Management: ServiceNow Risk Management

According to the ServiceNow Hardware Asset Management documentation, the Retired state indicates that the asset is no longer in use and is ready for disposal or reuse. The substates of the Retired state are:
Disposed: The asset has been discarded or recycled.
Donated: The asset has been given away to a charity or a non-profit organization.
Sold: The asset has been sold to a third party.
The substate Pending Disposal is not valid for the Retired state, as it is only available for the states In Stock and In Transit. The substate Destroyed is not valid for the Retired state, as it is only available for the state In Use. Reference:
ServiceNow Hardware Asset Management: Asset and CI management
ServiceNow Hardware Asset Management: Setting asset states and substates

A component is considered an IT asset when you want to perform hardware asset management (HAM) activities on it1.
HAM is a subset of IT asset management (ITAM) that focuses on the physical components of IT systems2.
HAM helps you to manage the entire lifecycle of your hardware assets, from planning and acquisition to retirement and disposal1.
Some of the HAM activities that require a component to be an IT asset are:
Manage its procurement: This involves creating and fulfilling asset requests, purchase orders, and stock order tasks for the component1.
Track its incurred costs: This involves tracking the financial information of the component, such as cost, depreciation, budget, and chargeback1.
Manage its maintenance contracts: This involves managing the vendor, warranty, and contract details of the component, as well as the return merchandise authorization (RMA) processes for products to be returned, replaced, or repaired1.
Therefore, the options that are also HAM activities are A. Manage its procurement, D. Track its incurred costs, and E. Manage its maintenance contracts.
The other options that are not HAM activities are:
Know its relationships to a business service: This involves mapping the component to other components and services in the configuration management database (CMDB)2. This is a configuration management (CM) activity, not a HAM activity.
Track its operational information: This involves tracking the current status, location, owner, and other attributes of the component that reflect its operational state2. This is also a CM activity, not a HAM activity. Reference:
1: Hardware Asset Management
2: What is Hardware Asset Management?