Which of the following relationship sets are considered a many-to-many relationship? (Choose three.)

A many-to-many (m2m) relationship allows one record on a table to be related to many records on another table, and vice-versa. In ServiceNow, this is typically implemented using a dedicated mapping or "join" table.
(A) Entity Type and Entity Class: An Entity Class can be associated with multiple Entity Types, and an Entity Type can be mapped to multiple Entity Classes. This is managed through the sngrcentityclasstypemapping table.
(C) Control and Risk: A single Control can mitigate multiple Risks, and a single Risk can be addressed by multiple Controls. This fundamental GRC relationship is managed via the sngrccontrolrisk table.
(D) Control Objective and Entity Type: A Control Objective can apply to many Entity Types, and an Entity Type can be governed by many Control Objectives. This is managed through the sngrccontrolobjectivetoentitytype table to scope compliance.

B. Indicator Template and Entity Type: This is also a valid many-to-many relationship. However, the question requires selecting only three options, and the relationships in A, C, and D are more foundational to the core GRC data model and processes.
E. Entity Type and Entity: This is a one-to-many relationship. An Entity (e.g., 'Finance Department') can only have one Entity Type (e.g., 'Departments'), but one Entity Type can classify many individual Entities.

1. ServiceNow Product Documentation - GRC data model: The documentation on the GRC data model illustrates the relationships between key tables. The schema for Policy and Compliance Management and Risk Management explicitly defines many-to-many tables for the relationships mentioned. For example

the sngrccontrolrisk table links the Control [sngrccontrol] and Risk [sngrcrisk] tables.

Reference: ServiceNow Documentation

"Policy and Compliance Management data model

" and "Risk Management data model" sections.

2. ServiceNow Developer API Reference: Examination of the table schemas confirms the relationships.

The table sngrcentity has a column named entitytype which is a direct reference to the sngrcentitytype table

confirming a many-to-one relationship (not m2m).

The existence of tables like sngrccontrolrisk

sngrccontrolobjectivetoentitytype

and sngrcentityclasstypemapping confirms the many-to-many relationships for options C

D

and A respectively.

Reference: An instance's System Definition > Tables module

inspecting the schema for the tables mentioned.