A risk assessment rates a data leakage scenario as high before any controls are considered and as medium after encryption and access controls are taken into account. What do these two ratings represent, in order?
Select an answer to reveal the explanation.
Short Explanation
Think of the rating before your seatbelt and airbags versus after: same crash, different outcome. Before controls is inherent risk, after controls is residual risk. The trap is getting the order backwards, or mixing in appetite and tolerance, which describe what you're willing to accept rather than what you've measured.
Full Explanation
Inherent risk is the level of risk that exists before any controls are applied, reflecting the raw likelihood and impact of a scenario. Residual risk is what remains after existing or planned controls are taken into account. In this scenario, the high rating with no controls considered is inherent, and the medium rating after encryption and access controls is residual. The difference between them shows how much the controls contribute and supports decisions about whether further treatment is needed. Risk appetite is the broad amount of risk the enterprise is willing to accept in pursuit of its objectives, and risk tolerance is the acceptable variation around that appetite; both are thresholds set by management, not measured ratings of a scenario. Reversing inherent and residual describes the same two concepts in the wrong order, which would imply controls increased the risk. Risk capacity is the maximum risk the organization can absorb before its survival is threatened, again a limit rather than an assessment result. Exam caveat: residual risk is then compared with appetite to decide whether to accept or treat further. Operational check: confirm the risk register records both inherent and residual ratings for each scenario and names the controls credited for the difference.