Residual risk should be accepted when it lies within the organization's stated risk tolerance is correct.

Residual risk is the level of risk that remains after security controls have been applied. If that remaining risk falls inside the organizations stated risk tolerance then the organization may formally accept it as an informed business decision. Acceptance should be documented and owned by the appropriate risk owner and the organization can still choose to further mitigate, transfer, or avoid the risk if it is not acceptable.

Cloud Identity and Access Management is incorrect because it names a control or service rather than describing what residual risk means. It does not explain how to treat the risk that remains after controls are implemented.

Residual risk can be completely removed by adding more security controls is incorrect because in practice risk cannot usually be eliminated entirely. Adding controls can reduce risk but there are always trade offs in cost, complexity, usability, and unknown threats that leave some residual risk.

Residual risk equals the total risk present in an information system is incorrect because total risk normally refers to the risk before controls are applied. Residual risk is what remains after controls, so it is a different and typically smaller value than total risk.

Full AWS Practitioner Certification Question