The effective management of risk requires specific types of action. Which of the following pairs of actions would be BEST to manage risk?

Staff training supports risk awareness but without analysis and exposure management it does not constitute a complete risk management process.

This pair covers the complete risk management lifecycle - identification surfaces potential threats, analysis quantifies likelihood and impact to prioritize them, and managing exposure involves selecting appropriate responses such as mitigation, avoidance, transfer, or acceptance. Together these three activities form the recognized core of any risk management process.

Controlling exposure addresses only one phase, and capital investment is not a recognized standard risk management action in ITIL frameworks.

Training and capital investment do not include the identification or analysis phases that are fundamental to structured risk management.