Which of the following is the BEST course of action when an organization wants to reduce likelihood in order to reduce a risk level?

Monitoring risk controls helps to verify their effectiveness and identify failures, but it does not directly reduce the likelihood of the risk event itself.

Implementing preventive measures, such as access controls or secure configurations, directly reduces the likelihood of a threat exploiting a vulnerability and thus decreases the probability of a risk event occurring.

Implementing detective controls aims to identify security incidents after they have occurred or are in progress, reducing the impact or enabling a quicker response, rather than reducing the likelihood of the event.

Transferring the risk (e.g., through insurance) shifts the financial burden to a third party but does not reduce the actual likelihood of the risk event occurring.