Controls are implemented to:

A.
eliminate risk and reduce the potential for loss.

B.
mitigate risk and eliminate the potential for loss.

C.
mitigate risk and reduce the potential for loss.

D.
eliminate risk and eliminate the potential for loss.

Explanation:
A countermeasure is defined as a control, method, technique, or procedure that is put into place to prevent a
threat agent from exploiting a vulnerability. A countermeasure is put into place to mitigate risk. A
countermeasure is also called a safeguard or control.
Incorrect Answers:
A: You can reduce risk but you can never completely eliminate it.
B: You can reduce the potential for loss but you can never completely eliminate it.
D: You can reduce risk or the potential for loss but you can never completely eliminate them.