Which term refers to the ongoing process of controlling and reducing exposure to risk through appropriate controls?

Which term refers to the ongoing process of controlling and reducing exposure to risk through appropriate controls?

• A. Fuzzing
• B. Risk Management
• C. Threat Modeling
• D. End of Line Comment

Answer: (B)

The concept being tested is risk management. It’s an ongoing, repeatable process aimed at reducing exposure to risk by selecting and applying appropriate controls, then monitoring and adjusting as conditions change. This starts with identifying what could go wrong and how it could impact assets or operations, then choosing technical, administrative, and physical controls to lower those risks to an acceptable level. Once controls are in place, you continuously track their effectiveness, re-evaluate risks as new threats appear, and update controls accordingly. That ongoing cycle of identification, mitigation, and monitoring is what makes risk management the correct fit. Fuzzing is about discovering vulnerabilities through input generation, threat modeling is typically a design-stage activity to identify potential threats, and an end-of-line comment is just programming syntax—none of these capture the persistent, control-focused process like risk management.

The concept being tested is risk management. It’s an ongoing, repeatable process aimed at reducing exposure to risk by selecting and applying appropriate controls, then monitoring and adjusting as conditions change. This starts with identifying what could go wrong and how it could impact assets or operations, then choosing technical, administrative, and physical controls to lower those risks to an acceptable level. Once controls are in place, you continuously track their effectiveness, re-evaluate risks as new threats appear, and update controls accordingly. That ongoing cycle of identification, mitigation, and monitoring is what makes risk management the correct fit. Fuzzing is about discovering vulnerabilities through input generation, threat modeling is typically a design-stage activity to identify potential threats, and an end-of-line comment is just programming syntax—none of these capture the persistent, control-focused process like risk management.