Suppose your company has just passed a security risk assessment exercise.

The correct answer is D because the remaining or residual risk is now 10%, which is below the organization’s defined risk threshold of 20%. In CEH risk-management concepts, risk assessment identifies and evaluates the potential damage or loss to assets, and risk treatment decisions include mitigation, avoidance, transfer, or acceptance. Risk acceptance means making an informed decision to accept the remaining potential for damage or loss. The guide also describes minimum acceptable risk as an organization’s threshold based on confidentiality, integrity, availability, and resource decisions. Since controls have already reduced risk from 50% to 10%, additional controls to reach 0% would likely waste resources and reduce business profit. Avoiding the risk could stop the project unnecessarily. Mitigation has already been performed successfully. Therefore, the best business-aligned decision is to formally accept the residual risk and continue the project.