GSLC · Question #555
Which of the following statements are true about security risks? Each correct answer represents a complete solution. Choose three.
The correct answer is B. They can be analyzed and measured by the risk analysis process. C. They are considered an indicator of threats coupled with vulnerability. D. They can be mitigated by reviewing and taking responsible actions based on possible. Security risks cannot be fully eliminated - they can only be analyzed, quantified, and mitigated to an acceptable residual level through formal risk management processes.
Question
Which of the following statements are true about security risks? Each correct answer represents a complete solution. Choose three.
Options
- AThey can be removed completely by taking proper actions.
- BThey can be analyzed and measured by the risk analysis process.
- CThey are considered an indicator of threats coupled with vulnerability.
- DThey can be mitigated by reviewing and taking responsible actions based on possible
How the community answered
(41 responses)- A10% (4)
- B90% (37)
Why each option
Security risks cannot be fully eliminated - they can only be analyzed, quantified, and mitigated to an acceptable residual level through formal risk management processes.
Security risks can never be completely removed because residual risk always remains after controls are applied; the goal of risk management is reduction to an acceptable level, not total elimination.
Risk analysis is a structured process that identifies threats and vulnerabilities, evaluates likelihood and impact, and produces quantifiable measurements that guide security decision-making.
Risk is formally defined as the function of a threat exploiting a vulnerability to produce harm - making it inherently an indicator of the intersection between threats and existing vulnerabilities.
Risk mitigation involves reviewing identified risks and implementing controls, countermeasures, or process changes to reduce the probability or impact of a risk to an acceptable level.
Concept tested: Security risk management principles and risk analysis process
Source: https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final
Topics
Community Discussion
No community discussion yet for this question.