The correct answer is a. The goal of risk mitigation is to reduce risk to a level acceptable to the organization. Therefore risk needs to be defined for the organization through risk analysis, business impact assessment, and/or vulnerability assessment.
Answer b is not possible. Answer c is called risk transference. Answer d is a distracter.
The correct answer is c. The Single Loss Expectancy (or Exposure) figure may be created as a result of a Business ...