Which statement best describes residual risk after risk controls are deployed?

• A. It is zero once controls are applied
• B. It is the amount of risk eliminated by controls
• C. It is the amount of risk that remains after vulnerabilities are classified and countermeasures are deployed
• D. It increases due to new vulnerabilities

Answer: (C)

Residual risk is the amount of risk that remains after risk controls are in place. In security terms, risk comes from threats exploiting vulnerabilities with potential impact. Implementing countermeasures reduces either the chance of exploitation or the impact, but no control is perfect, some vulnerabilities persist, and new threats can appear. So after deployment, you still have some risk left, and that remaining level is the residual risk. This is why it’s not zero and not the amount eliminated by controls; it’s what remains after mitigation efforts.