ITPEC IP April 2026 Question 36

Vulnerability, threat, risk — a threat exploits a vulnerability, and the potential for damage that results is the risk.

• •A Vulnerability — a weakness in an information asset or in its protection: an unpatched program, a weak password, an unlocked server room
• •B Threat — something that can cause harm by exploiting that weakness: an attacker, malware, a fire, an operator's mistake
• •C Risk — the potential for damage when a threat exploits a vulnerability, judged by its likelihood and its impact

The sentence then reads: a vulnerability in an asset can be exploited by a threat, and the potential for damage is called a risk.

Answer (b)

Why not others:

• •(a) Threat, Risk, Vulnerability — puts the threat inside the asset and has a risk doing the exploiting; the weakness in the asset is the vulnerability, and what exploits it is the threat
• •(c) Risk, Threat, Vulnerability — swaps the first and last terms: the weakness is not a risk, and the potential for damage is not a vulnerability
• •(d) Risk, Vulnerability, Threat — has a vulnerability exploiting something; a vulnerability is passive, only a threat acts on it

Key rule: A risk exists only where a threat meets a vulnerability of a valuable asset, which is why risk is often assessed as asset value × threat × vulnerability.

Security · AI-written, may contain errors