312-50V9 · Question #355
What kind of risk will remain even if all theoretically possible safety measures would be applied?
The correct answer is A. Residual risk. Residual risk is the risk that remains after all feasible controls and safeguards have been applied. Even a theoretically complete set of security measures cannot reduce risk to zero.
Question
What kind of risk will remain even if all theoretically possible safety measures would be applied?
Options
- AResidual risk
- BInherent risk
- CImpact risk
- DDeferred risk
How the community answered
(50 responses)- A90% (45)
- B2% (1)
- C6% (3)
- D2% (1)
Why each option
Residual risk is the risk that remains after all feasible controls and safeguards have been applied. Even a theoretically complete set of security measures cannot reduce risk to zero.
Residual risk is formally defined as the remaining risk after all possible risk treatment measures and controls have been applied. It is a foundational concept in frameworks such as ISO 27001 and NIST SP 800-30, acknowledging that no control set can achieve zero risk. Organizations must accept or further treat residual risk as part of their risk management process.
Inherent risk is the level of risk that exists before any controls or mitigation measures are applied, which is the opposite scenario described in the question.
Impact risk is not a standard term in recognized risk management frameworks - impact refers to the magnitude of a risk event's consequence, not a category of risk.
Deferred risk is not a recognized risk classification in standard frameworks such as ISO 27001 or NIST SP 800-30.
Concept tested: Residual risk definition in risk management frameworks
Source: https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final
Topics
Community Discussion
No community discussion yet for this question.