Controls are implemented to:

The correct answer is C. mitigate risk and reduce the potential for loss. Controls are implemented to mitigate risk and reduce the potential for loss. The key distinction here is that controls cannot fully eliminate risk or completely eliminate the potential for loss - they can only lessen (mitigate) the likelihood or impact of a risk and reduce (not…

Submitted by emma.c· Apr 18, 2026Risk Identification, Monitoring and Analysis

Question

Controls are implemented to:

Options

Aeliminate risk and reduce the potential for loss
Bmitigate risk and eliminate the potential for loss
Cmitigate risk and reduce the potential for loss
Deliminate risk and eliminate the potential for loss

How the community answered

(28 responses)

A
4% (1)
C
93% (26)
D
4% (1)

Explanation

Controls are implemented to mitigate risk and reduce the potential for loss. The key distinction here is that controls cannot fully eliminate risk or completely eliminate the potential for loss - they can only lessen (mitigate) the likelihood or impact of a risk and reduce (not eliminate) the potential for loss. Security professionals must accept that residual risk always remains after controls are applied. Choices A, B, and D are incorrect because they use 'eliminate' for at least one of the two terms, which overstates what controls can achieve.

Topics

#Security Controls#Risk Management#Risk Mitigation

Community Discussion

No community discussion yet for this question.

Full SSCP Practice