Which task outcome includes providing risk responses for determined risks?

• A. Authorization decisions are approved or denied.
• B. Risk responses for determined risks are provided.
• C. The information system is monitored for changes.
• D. Security and privacy reports are completed.

Answer: (B)

The main idea here is that after risks are identified and their levels determined, the next essential step is to plan and implement actions that address those risks. Providing risk responses for determined risks means outlining and carrying out concrete strategies (such as mitigating, transferring, avoiding, or accepting the risk) and putting the necessary controls or measures in place. This turns assessment results into active risk treatment, which is how risk management moves from evaluation to action.

The other activities described—making authorization decisions, monitoring the system for changes, and completing security and privacy reports—are important parts of governance, ongoing operations, and compliance, but they don’t capture the specific step of deciding and delivering responses to the risks that have been determined to require action.