The likelihood and impact (consequence) of a threat actor exercising a vulnerability is called?

The likelihood and impact (consequence) of a threat actor exercising a vulnerability is called?

• A. Risk
• B. Threat
• C. Impact
• D. Exposure

Answer: (A)

In information security, risk is defined as the combination of how likely it is that a threat actor will exploit a vulnerability and the potential consequences if that exploitation occurs. This question points to that exact idea—risk merges both the probability of an event and the impact it would have. A threat is simply the actor or event that could cause harm, not its likelihood or severity. Impact describes how bad the outcome could be, but not how likely it is. Exposure refers to being open to threats, not the overall risk level. So the concept described by the question is risk.

In information security, risk is defined as the combination of how likely it is that a threat actor will exploit a vulnerability and the potential consequences if that exploitation occurs. This question points to that exact idea—risk merges both the probability of an event and the impact it would have. A threat is simply the actor or event that could cause harm, not its likelihood or severity. Impact describes how bad the outcome could be, but not how likely it is. Exposure refers to being open to threats, not the overall risk level. So the concept described by the question is risk.