Which of the following statements is true about residual risks?

The correct answer is C. It is the probabilistic risk after implementing all security measures.. Residual risk is the remaining level of risk that persists after all security controls, safeguards, and countermeasures have been applied. No set of controls can eliminate 100% of risk, so residual risk represents what is left over and must be accepted by management. Option A des

Security and Privacy Governance, Risk Management, and Compliance Program

Question

Options

AIt is a weakness or lack of safeguard that can be exploited by a threat.
BIt can be considered as an indicator of threats coupled with vulnerability.
CIt is the probabilistic risk after implementing all security measures.
DIt is the probabilistic risk before implementing all security measures.

How the community answered

(21 responses)

A
5% (1)
B
10% (2)
C
86% (18)

Explanation

Residual risk is the remaining level of risk that persists after all security controls, safeguards, and countermeasures have been applied. No set of controls can eliminate 100% of risk, so residual risk represents what is left over and must be accepted by management. Option A describes a vulnerability; Option B describes risk itself (threat × vulnerability); Option D describes inherent risk - the risk level that exists before any controls are applied. Residual risk is specifically the post-control remainder.

Topics

#Residual Risk#Risk Management#Risk Definition#Security Controls

Community Discussion

No community discussion yet for this question.

Full CAP Practice