What describes the risk that exists before mitigation actions are applied?

• A. Residual Risk
• B. Exposure
• C. Inherent Risk
• D. Threat

Answer: (C)

The concept being tested is the baseline level of risk that exists before any safeguards are in place. This is inherent risk—the risk present in a process or environment in its natural state, assuming no controls are applied. It reflects the potential impact and likelihood of harm given the current assets, threats, and vulnerabilities before mitigation efforts.

Residual risk, by contrast, is the amount of risk that remains after controls are implemented. Exposure refers to how exposed a system or asset is to threats, which influences risk but isn’t the baseline itself. A threat is a potential cause of harm, not a measure of risk level. So the best description of the risk before mitigation actions are applied is inherent risk.