Which term refers to the determination of the best way to address an identified risk?

• A. Penetration Testing
• B. Risk Treatment
• C. Legacy IT Systems
• D. Non-repudiation

Answer: (B)

The main concept is risk treatment in risk management—the process of deciding how to respond to an identified risk. After risks are identified and evaluated, you choose the most appropriate response to bring risk to an acceptable level. This involves selecting and implementing controls or measures to reduce the likelihood or impact, or choosing to transfer the risk (for example, via insurance), avoid it (by changing plans or procedures), or accept it once residual risk remains. Penetration testing is about uncovering vulnerabilities, not resolving identified risks. Legacy IT systems describe outdated technology, not the decision process for risk response. Non-repudiation relates to proving the origin and integrity of a message, not risk treatment.