第68題： （ ）is not included in Information Security Risk Assessment Process.
A. Establishing information security risk criteria
B. Identifying the information security risks
C. Formulating an information security risk treatment plan
D. Analysing the information security risk
答案解析與討論：www.shc2b.com/st/3976520693.html

第69題： （ ） is not included in Perform Integrated Change Control Process.
A. Defining subsidiary plans
B. Approving changes
C. Managing changes to deliverables
D. Reviewing all change requests
答案解析與討論：www.shc2b.com/st/3976618660.html

第70題： Every documented change request needs to be either approved or rejected by a responsible individual sually（ ）.
A. the project sponsor
B. an individual
C. any stakeholeder
D. quality controller
答案解析與討論：www.shc2b.com/st/3976712838.html