Security+ risk responses and residual risk
Risk acceptance is an informed authorized decision to retain exposure. Avoidance stops the risky activity; mitigation reduces likelihood or impact; transfer shifts specified consequences through arrangements such as insurance. Controls usually leave residual risk. Record owners, decisions, review dates, and assumptions so a temporary exception does not silently become permanent. Technical severity alone does not capture the full business consequence.
How to read the scenario
Ask what changed: the activity, the controls, who bears a consequence, or the decision to tolerate the risk.
Identify the required outcome, the evidence already provided, and the limits on the technician’s action. Compare every option against those details before deciding. Record why the closest alternative does not meet the stated need.
Original practice example
An authorized owner documents that a low-impact risk will remain without additional treatment within approved tolerance. Which response is this?
- Risk transfer
- Risk avoidance
- Risk acceptance
- Risk mitigation
Show the answer and explanation
Risk acceptance
Risk acceptance retains the risk through an informed and authorized decision.
Study questions
Which objective does this guide support?
SY0-701, objective 5.2. This independent guide supports original practice and does not replace the full official objectives.
What should I watch for in a scenario?
Ask what changed: the activity, the controls, who bears a consequence, or the decision to tolerate the risk.
Source and version
CompTIA official SY0-701 objectives, objective 5.2. Verified November 5, 2026. This guide targets SY0-701. SY0-801 is expected around November 17, 2026 and is outside this edition.