Cisco Cyber Security Practice Exam

What term best describes the practice of taking responsible steps to eliminate risk, while still having some risks that are managed through multiple controls?

1. Risk acceptance

2. Risk mitigation

3. Due diligence

4. Risk transfer

The correct answer is: Due diligence

The term that best describes the practice of taking responsible steps to eliminate risk, while still having some risks managed through multiple controls, is risk mitigation. Risk mitigation involves identifying potential risks, implementing measures to reduce the likelihood or impact of these risks, and maintaining some level of risk that can be managed with controls. This approach recognizes that while it is not feasible to eliminate all risks entirely, organizations can take proactive steps to manage and minimize risks through a combination of preventative measures and controls. In contrast, risk acceptance refers to acknowledging a certain level of risk and deciding not to take any action to reduce it, essentially "accepting" the risk as is. Due diligence involves the careful analysis and assessment of risks, typically in preparation for a transaction or investment, rather than actively managing them through controls. Risk transfer involves shifting the risk to another party, such as through insurance, rather than managing it directly. Thus, mitigation aligns with the goal of eliminating or reducing risks while recognizing that some risks remain to be managed.