Which of the following relations correctly describes residual risk?

The correct answer is D. Residual Risk = Threats x Vulnerability x Asset Value x Control Gap. Residual risk is the risk that remains after security controls have been applied. The correct formula is: Residual Risk = Threats × Vulnerability × Asset Value × Control Gap. 'Control Gap' represents the difference between the ideal control effectiveness and the actual…

Security and Privacy Governance, Risk Management, and Compliance Program

Question

Options

AResidual Risk = Threats x Vulnerability x Asset Gap x Control Gap
BResidual Risk = Threats x Exploit x Asset Value x Control Gap
CResidual Risk = Threats x Exploit x Asset Value x Control Gap
DResidual Risk = Threats x Vulnerability x Asset Value x Control Gap

How the community answered

(16 responses)

B
6% (1)
D
94% (15)

Explanation

Residual risk is the risk that remains after security controls have been applied. The correct formula is: Residual Risk = Threats × Vulnerability × Asset Value × Control Gap. 'Control Gap' represents the difference between the ideal control effectiveness and the actual effectiveness of implemented controls. Option A incorrectly uses 'Asset Gap' instead of 'Asset Value,' and options B and C introduce 'Exploit' in place of 'Vulnerability,' which is not part of the standard residual risk formula.

Topics

#Residual Risk#Risk Calculation#Control Effectiveness#Risk Components

Community Discussion

No community discussion yet for this question.

Full CAP Practice