CompTIA Security+ Exam Prep

Answer: D - When trying to protect against total risk and residual risk, approach options include risk avoidance, risk mitigation, risk acceptance, and risk transfer. Risk avoidance is the act of terminating the activity that is introducing the risk. Risk mitigation is where the risk is decreased to a level considered acceptable enough to continue conducting business. Risk acceptance is when a company understands the level of risk and the potential cost of damage by the risk and opts to not implement any countermeasure. When a company chooses to purchase insurance to protect again risks, they are transferring the risk.