Select the option that presents an INCORRECT attribution of residual or secondary risk. O a. Organizations rely on various suppliers and partners. Even with due diligence, supply chain risks persist. A compromised supplier could introduce vulnerabilities into the organization's systems, creating residual risk. O b. Organizations heavily rely on encryption to protect data in transit and at rest. However, if encryption keys are compromised (secondary risk), attackers can decrypt sensitive information, exposing data. It is an example of residual risk. O c. Despite implementing security controls and risk assessments, a data breach remains a residual risk through a third-party vendor. For instance, if a vendor experiences a breach, sensitive data shared with them could be compromised. O d. Suppose an organization diligently patches software vulnerabilities to reduce the risk of exploitation. However, occasionally, a patch introduces new issues (secondary risk). For instance, a critical patch might inadvertently break a critical application, impacting operations. It is an example of secondary risk.

Select the option that presents an INCORRECT attribution of residual or secondary risk. O a. Organizations rely on various suppliers and partners. Even with due diligence, supply chain risks persist. A compromised supplier could introduce vulnerabilities into the organization's systems, creating residual risk. O b. Organizations heavily rely on encryption to protect data in transit and at rest. However, if encryption keys are compromised (secondary risk), attackers can decrypt sensitive information, exposing data. It is an example of residual risk. O c. Despite implementing security controls and risk assessments, a data breach remains a residual risk through a third-party vendor. For instance, if a vendor experiences a breach, sensitive data shared with them could be compromised. O d. Suppose an organization diligently patches software vulnerabilities to reduce the risk of exploitation. However, occasionally, a patch introduces new issues (secondary risk). For instance, a critical patch might inadvertently break a critical application, impacting operations. It is an example of secondary risk.