IPA IP 2025 Question 93

Something that becomes a cause of harm to information assets — that is a threat: malware, an attacker, a fire, an operating mistake.

Security risk management separates three ideas:

• •Threat: the potential cause of an incident that harms an asset (unauthorized access, a virus, a disaster, human error)
• •Vulnerability: a weakness of an asset or system that a threat can exploit (an unpatched program, a weak password)
• •Risk: the chance of harm when a threat exploits a vulnerability, judged by its likelihood and the size of its impact

A threat with no vulnerability to exploit causes no damage, and a vulnerability with no threat stays harmless; risk arises from the two together.

Answer (c)

Why not others:

• •(a) — a weakness an attacker can take advantage of is a vulnerability
• •(b) — likelihood of damage combined with its scale is how a risk is expressed
• •(d) — the possibility of damage from an attack exploiting a weakness is also risk

Key rule: Threat = cause of harm, vulnerability = weakness it exploits, risk = likelihood × impact of the two meeting.

Security · AI-written, may contain errors