Concerning residual risk which of the following statements is true? Response:

This describes a vulnerability, which is a weakness that a threat can exploit, not residual risk.

This describes the fundamental concept of risk itself (threat multiplied by vulnerability), not specifically the risk remaining after controls are in place.

Residual risk refers to the amount of risk that remains after security controls, safeguards, and countermeasures have been implemented to mitigate identified threats and vulnerabilities. This is the risk that an organization has accepted, either because it cannot be entirely eliminated or because the cost of further mitigation outweighs the potential benefits.

This describes inherent or raw risk, which is the level of risk existing before any security measures or controls have been applied.