SSCP · Question #1323
The amount of risk remaining after security controls have been applied is referred to as:
The correct answer is B. Residual risk. Residual risk is the level of risk that remains even after all implemented security controls and countermeasures have been put in place and are operating effectively.
Question
The amount of risk remaining after security controls have been applied is referred to as:
Options
- ARemaining risk
- BResidual risk
- CAcceptable risk
- DOutstanding risk
- EEnduring risk
How the community answered
(25 responses)- B92% (23)
- D4% (1)
- E4% (1)
Why each option
Residual risk is the level of risk that remains even after all implemented security controls and countermeasures have been put in place and are operating effectively.
"Remaining risk" is a general term, but "residual risk" is the specific and correct terminology in risk management.
Residual risk is the risk that remains after all reasonable and applicable security controls, safeguards, and countermeasures have been implemented and applied.
"Acceptable risk" is a policy decision about how much residual risk an organization is willing to tolerate, not the name for the risk itself.
"Outstanding risk" is not a standard term in cybersecurity risk management.
"Enduring risk" is not a standard term in cybersecurity risk management.
Concept tested: Risk management terminology (Residual risk)
Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility
Topics
Community Discussion
No community discussion yet for this question.