Which of the following statements are true about security risks? Each correct answer represents a complete solution. Choose three.

Security risks can never be completely removed because residual risk always remains after controls are applied; the goal of risk management is reduction to an acceptable level, not total elimination.

Risk analysis is a structured process that identifies threats and vulnerabilities, evaluates likelihood and impact, and produces quantifiable measurements that guide security decision-making.

Risk is formally defined as the function of a threat exploiting a vulnerability to produce harm - making it inherently an indicator of the intersection between threats and existing vulnerabilities.

Risk mitigation involves reviewing identified risks and implementing controls, countermeasures, or process changes to reduce the probability or impact of a risk to an acceptable level.