The goal of IT security is risk elimination.

• A. True
• B. False
• C. Not specified
• D. Not applicable

Answer: (B)

IT security aims to reduce risk to an acceptable level rather than eliminate all risk. In the real world, threats, vulnerabilities, and even human error continually evolve, so it isn’t feasible to remove every risk entirely. The practice focuses on identifying valuable assets, assessing how likely threats are and how bad their impact would be, and then applying controls to lessen both the probability of a breach and its consequences. This process creates residual risk—the amount that remains after safeguards are in place—which organizations often accept when further reduction is too costly or would hurt usability. A layered approach—patching, access controls, monitoring, backups, and incident response—reduces risk but cannot guarantee perfect security. So the goal is about risk reduction and risk management, not total elimination.