Which of the following statements are true about security risks? Each correct answer represents a complete solution. Choose three.

Question

Options

• AThey can be removed completely by taking proper actions.
• BThey can be analyzed and measured by the risk analysis process.
• CThey can be mitigated by reviewing and taking responsible actions based on possible risks.
• DThey are considered an indicator of threats coupled with vulnerability.

• A
  12% (3)
• B
  88% (23)

Explanation

B is correct: Risk analysis processes exist specifically to analyze and measure security risks, assessing likelihood and potential impact. C is correct: Risks can be mitigated-reduced to an acceptable level-through review and responsible action; mitigation is a core risk response strategy. D is correct: In security, risk is defined as the combination of a threat (an actor or event that could cause harm) and a vulnerability (a weakness that can be exploited), making it an indicator of threats coupled with vulnerability. A is incorrect because security risks can never be completely eliminated; residual risk always remains. Proper controls reduce risk to an acceptable level, but complete removal is not achievable.

No community discussion yet for this question.