If the final set of security controls does not eliminate all risk in a system, what could be done next?

The correct answer is C. If the residual risk is low enough, it can be accepted. In risk management, it is virtually impossible to eliminate 100% of risk from any system. After applying security controls, the remaining exposure is called 'residual risk.' The standard practice is to evaluate whether the residual risk falls within an acceptable threshold…

Information Security and Ethical Hacking Fundamentals

Question

Options

AContinue to apply controls until there is zero risk.
BIgnore any remaining risk.
CIf the residual risk is low enough, it can be accepted.
DRemove current controls since they are not completely effective.

How the community answered

(60 responses)

A
5% (3)
B
2% (1)
C
90% (54)
D
3% (2)

Explanation

In risk management, it is virtually impossible to eliminate 100% of risk from any system. After applying security controls, the remaining exposure is called 'residual risk.' The standard practice is to evaluate whether the residual risk falls within an acceptable threshold defined by the organization's risk appetite. If it does, the risk can be formally accepted - often documented by a risk owner or management. Option A is impractical because zero risk is unattainable. Option B (ignoring risk) is irresponsible and violates sound security governance. Option D is counterproductive - removing partially effective controls would increase overall risk rather than reduce it.

Topics

#risk management#residual risk#security controls#risk acceptance

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice