After the completion of the pen test, you have provided the client with a list...

The correct answer is B, Residual risk. In CEH risk-management terminology, residual risk is the amount of risk that remains after security controls, safeguards, countermeasures, or mitigation strategies have been applied. A penetration test identifies vulnerabilities, threats, and weaknesses that may expose an organization to risk. After the tester recommends controls such as patching, access control improvements, network segmentation, monitoring, hardening, or user awareness training, those controls reduce the likelihood or impact of exploitation. However, security controls rarely remove all risk completely. The remaining exposure is known as residual risk, and management must decide whether to accept, transfer, avoid, or further mitigate it. Inherent risk is the original level of risk before any controls are applied. Gap analysis is a comparison between the current security state and the desired or required state. Total risk usually refers to the overall risk before accounting for implemented safeguards. Therefore, the best term for risk remaining after controls is residual risk.