What Is the Risk Remaining After Controls and Mitigating Factors Are Applied?

SY0-701 By islever Editorial Last updated

Short answer

A Residual

Question

Which of the following best describes the risk present after controls and mitigating factors have been applied?
  1. Residual Correct Answer
  2. Avoided
  3. Inherent
  4. Operational

Key Takeaways

The question tests your ability to distinguish risk terminology—specifically that 'residual' refers to leftover risk after safeguards, while 'inherent' is the risk before controls are applied.

Residual risk is the risk that remains after security controls and mitigation strategies are implemented. This CompTIA Security+ (SY0-701) concept is widely confirmed by community consensus, with all voters selecting 'Residual.'

Common mistake: Choosing 'Inherent' is a common mistake because it is the risk before controls, not after; learners often confuse the order of risk assessment phases.

Expert Analysis

Why the Answer Is Correct

Residual risk is defined as the risk that persists after security controls, safeguards, and mitigating factors have been applied. It represents the remaining likelihood and impact that cannot be fully eliminated, only reduced to an acceptable level. This aligns directly with the question's phrasing, making 'Residual' the clear and correct choice.

Why the Other Options Are Wrong

  • Avoided (B) refers to a risk response strategy where the risk is eliminated by not engaging in the risky activity, not the leftover risk after controls.
  • Inherent (C) is the level of risk before any controls are implemented, the opposite of what the question asks.
  • Operational (D) is a broad category of day-to-day risks, not a specific risk state defined by post-control residual assessment.

Community Comment Notes

Community comments unanimously support 'Residual,' with one user humorously comparing it to 'the amount of money in my account after my bills are paid.' Another comment explicitly states that residual risk 'cannot be completely eliminated, only reduced to an acceptable level,' reinforcing the core definition. These comments confirm the consensus and provide practical mnemonic value.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Remember the order: inherent risk comes first, then controls are applied, leaving residual risk. If the question mentions 'after controls' or 'remaining risk,' the answer is always 'Residual.'

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Mitch717 👍 4 Answered A
    Residual. The amount of money in my account after my bills are paid.
  2. jafyyy 👍 2
    A This is the risk that remains after controls and mitigation efforts have been applied.
  3. AndyK2 👍 1 Answered A
    A. Residual Rationale: Residual risk is the remaining risk after implementing security controls and mitigation strategies Represents the risk that persists even after applying protective measures Cannot be completely eliminated, only reduced to an acceptable level Reflects the potential impact and likelihood of a risk after implementing safeguards
  4. Ina22 👍 3
    A. Residual

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide