Exam CRISC topic 1 question 216 discussion

Answer should be A

A 100%. It's pretty much the word-for-word definition of residual risk

The correct answer is A. By determining remaining vulnerabilities after countermeasures are in place. Residual risk is the risk that remains after countermeasures have been implemented to reduce or eliminate a risk. It is the portion of the risk that cannot be controlled or mitigated.

A. By determining remaining vulnerabilities after countermeasures are in place. Residual risk is the risk that remains after security countermeasures have been implemented. It represents the level of risk that an organization or system still faces even with the security controls and measures in place. To determine the residual risk, you assess the vulnerabilities that are still present or partially mitigated after implementing security measures, and you evaluate the potential impact of these remaining vulnerabilities. This helps in understanding the level of risk that the organization or system still needs to manage and be aware of.

Residual risk refers to the level of risk that remains after risk mitigation measures have been implemented. Determining residual risk involves assessing the remaining risk exposure that an organization or system faces despite the controls and safeguards that have been put in place.

Answer should be A.

answer should be A as risk remaining after security measures have been applied is the definition of residual Risk