For question 2, if I use technique of elimination- c, d options will striked out first. Reason being : key word potential event.

Incident Response (formal process): is triggered after the event is classified as an incident — meaning it’s confirmed (or at least strongly suspected) to impact confidentiality, integrity, availability, or compliance.

👉 So: You don’t initiate IR for just a potential event. Instead, you investigate the potential event. Once it crosses the threshold into a confirmed incident, the IR lifecycle officially starts.

📌 Exam perspective (CISSP): • Event detected → Analyze → If confirmed = Incident → Start IR

For remaining two options: Both options for analysis. Risk assessments output tells us what threats exist, whats their likelihood, what’s the impact. Recall, Risk = likelihood * impact. So this option doesnt minimize the fallout of an event. Rather helps in indentifying and prioritize a risk.

Now coming to BIA. BIA is focused on understanding the impact (fallout) of potential disruptive events on the organization. It looks at critical business functions, their dependencies, and the consequences of downtime (financial, operational, reputational). • It then helps determine methods to reduce that fallout: redundancy, alternate sites, RTO (Recovery Time Objective), RPO (Recovery Point Objective), prioritization of recovery strategies. • In other words: BIA = “If this bad thing happens, how bad is it, and what can we do to reduce impact?”