ITPEC IP April 2026 Question 36

Vulnerability, threat, risk — a threat can exploit a vulnerability, creating the possibility of damage called risk.

A vulnerability is a weakness in an asset or control. A threat is a cause or actor capable of exploiting that weakness. Risk combines the possibility and impact of the resulting harm.

Answer (b)

Why not others: (a) says a risk exploits a threat; (c) treats risk as the weakness; (d) says a vulnerability exploits risk. Each reverses the standard causal relationship.

Key rule: Remember the chain: vulnerability is the weakness, threat is what may exploit it, and risk is the potential loss produced by that interaction.

AI-generated — may contain errors