A manager is building out the organisation's security governance and wants to cover the components NIST identifies. Which two are among those components? Choose two.

Answer: B. Strategic planning
C. Enterprise architecture

SP 800-100 names five governance components: strategic planning, organisational structure, roles and responsibilities, enterprise architecture, and policies and guidance. Testing and triage are programme activities, not governance components.

Source: NIST SP 800-100 (NIST) — Sec. 2.2 Governance Components