Which of the following is a valid use of Entity Types and Entities in risk management?

• A. To Monitor Risk Exposure
• B. To Remediate Vulnerabilities
• C. To Perform Policy Exceptions
• D. To Perform Risk Audits

Answer: (A)

The main idea being tested is how Entity Types and Entities are used to organize and connect risk data so you can see how risk looks across the business. These constructs create a taxonomy for what you’re measuring—defining categories (like Asset, Application, or Vendor) and the specific items within those categories (the entities). By linking risks to these entities, you can compute and visualize risk exposure for each item and across the portfolio.

This makes monitoring risk exposure the best use. When risks are attached to concrete entities, you can track scores, trends, and thresholds by asset or process, giving you continuous visibility into where risk is concentrated and how it changes over time. It supports dashboards, heat maps, and alerts that tell risk owners where to focus mitigation efforts.

Remediation, policy exceptions, and audits are separate activities that rely on the risk data created via entity types and entities, but they are not the primary purpose of these structures themselves. Entity types and entities provide the context and linkage needed to monitor risk exposure effectively across the organization.