Which of the following is a way of responding to risk with active countermeasures?

• A. Risk reduction
• B. Risk acceptance
• C. Risk avoidance
• D. All of the above

Answer: (A)

Responding to risk with active countermeasures means taking concrete steps that lower the exposure to threats. Reducing risk is about putting safeguards in place that decrease either how likely a threat is to succeed or how severe its impact would be if it did. Examples include applying patches, enforcing strong authentication, segmenting networks, and implementing regular backups—actions you take to actively lessen risk while continuing operations.

Risk acceptance isn’t an active countermeasure because it’s a decision not to act, choosing to live with the risk. Risk avoidance is also an action, but it’s about eliminating exposure by changing plans or stopping a activity, which isn’t the same as implementing controls to reduce risk. Saying all of the above would imply acceptance and avoidance are active countermeasures, which isn’t how these terms are typically used. So the best fit is reducing risk through active controls.