To which level the risk should be reduced to accomplish the objective of risk management?
A.
To a level where ALE is lower than SLE
B.
To a level where ARO equals SLE
C.
To a level that an organization can accept
D.
To a level that an organization can mitigate
Explanation:
The main objective of risk management is to reduce risk to a level that the organization or
company will accept, as the risk can never be completely eliminated.
Answer D is incorrect. Risk mitigation involves identification, planning, and conduct of actions for
reducing risk. Because the elimination of all risk is usually impractical or close to impossible, it is
aimed at reducing risk to an acceptable level with minimal adverse impact on the organization’s
resources and mission.