Which of the following steps has the goal to reduce the level of risk to the IT system and its data to an acceptable level?

Question

Options

• ARecommended Controls
• BResults Documentation
• CImpact Analysis
• DRisk Determination

• A
  83% (34)
• B
  5% (2)
• C
  10% (4)
• D
  2% (1)

Explanation

Recommended Controls is correct because this step in the risk assessment process involves identifying and proposing safeguards or countermeasures specifically aimed at reducing identified risks to an acceptable level - it's the action-oriented step where you decide what to do about the risk.

Why the distractors are wrong:

• Results Documentation (B) is about recording findings from the risk assessment, not taking action to reduce risk.
• Impact Analysis (C) evaluates the consequences of a threat exploiting a vulnerability - it measures potential harm but doesn't reduce it.
• Risk Determination (D) assesses the likelihood and magnitude of risk, producing a risk rating - again, analysis only, not mitigation.

Memory tip: Think of the steps as a sequence - you analyze, then determine, then recommend controls (act), then document. Controls are the only step where someone is actually saying "here's how we fix/reduce this risk," making A the clear answer whenever a question asks about reducing risk to an acceptable level.

No community discussion yet for this question.