200-201 Security Policies and Procedures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Acceptable risk

  Why it's wrong here

  Acceptable risk is a judgement that exposure falls within tolerance, not the measured remainder after controls. It is tempting because acceptance often follows residual-risk evaluation, and would be correct if the question asked what an organisation decides about risk it chooses to live with.

• ✗

  Inherent risk

  Why it's wrong here

  Inherent risk is the exposure present before any controls are applied, so it describes the starting point rather than the residue. It is tempting because both terms quantify risk around controls, and inherent risk would be the correct answer if the question asked for risk prior to mitigation.

• ✗

  Transfer risk

  Why it's wrong here

  Risk transfer shifts financial impact to another party, such as an insurer, and says nothing about what survives control implementation. It is tempting because it is a genuine risk-treatment option, and would be correct if the scenario asked how an organisation offloads the cost of a realised threat.

• ✓

  Residual risk

  Why this is correct

  Residual risk is the exposure that persists once security controls have been applied, directly matching the stem's requirement for risk remaining after implementation. Inherent risk exists before controls; residual risk is what survives them, and it must be accepted, transferred, mitigated further, or avoided through risk management decisions.

Go deeper

Related to this question