Exam CISM topic 1 question 202 discussion

The primary objective of a risk response strategy should be the selection of appropriate controls to mitigate identified risks to an acceptable level. This involves making decisions about the best ways to treat risks, such as avoiding the risk, transferring the risk to another party, reducing the negative impact of the risk, or accepting the risk. The selection of appropriate controls is the foundation for effective risk management and helps ensure that resources are directed towards the most critical risks facing the organization. While other factors, such as regulatory compliance and senior management buy-in, may be important considerations in the risk response process, the primary objective should always be the selection of appropriate controls to effectively manage risks.

C.selection of controls You cannot reduce the threats, they are external, you cannot control them

C. appropriate control selection.

"A" is wrong as Threat can't be reduced

C. appropriate control selection.

Risk response can be in the form of risk mitigation, risk acceptance, risk avoidance, or risk transfer.

A. Reduction of threats/risks. Risk reduction is the objective of risk response plan by the way of avoid/transfer/accept/mitigate. D is incorrect as Use of appropriate control measures or mechanisms is part of mitigate strategy.

objective is to reduce the threat. C is not objective.

PRIMARY objective would be to reduce the threat.