Which of the following statements is true about residual risks?

Question

Options

• AIt can be considered as an indicator of threats coupled with vulnerability.
• BIt is a weakness or lack of safeguard that can be exploited by a threat.
• CIt is the probabilistic risk after implementing all security measures.
• DIt is the probabilistic risk before implementing all security measures.

• A
  4% (2)
• B
  7% (4)
• C
  87% (47)
• D
  2% (1)

Explanation

Residual risk is the risk that remains after an organization has implemented all planned security controls and safeguards. Option C is correct because no security program can eliminate 100% of risk - what's left over is the residual risk, and it's inherently probabilistic since threats and outcomes are uncertain.

Why the distractors are wrong:

• A describes risk itself (threat × vulnerability), not the residual portion specifically.
• B defines a vulnerability - a weakness that can be exploited - which is a component of risk, not residual risk.
• D describes inherent risk - the baseline risk before any controls are applied. Residual is the after picture, not the before.

Memory tip: Think of it like sunscreen. Inherent risk = chance of sunburn with no sunscreen. Residual risk = the remaining chance of sunburn after applying sunscreen. You reduced it, but it's not zero.

No community discussion yet for this question.