Which term represents the likelihood and impact of a threat exploiting a vulnerability?

Which term represents the likelihood and impact of a threat exploiting a vulnerability?

• A. Risk
• B. Threat
• C. Attack Vector
• D. Exposure

Answer: (A)

This concept centers on risk: it represents how likely it is that a threat will exploit a vulnerability and how severe the consequences would be if that happens. Risk is typically seen as the combination of probability and impact, often summarized as likelihood times impact. A threat is a potential danger or actor that could cause harm, but it isn’t itself a measure of how probable or damaging an event would be. A vulnerability is a weakness that could be exploited. An attack vector is the route or method used to exploit that vulnerability. Exposure describes how exposed the asset is to threats, which can influence risk but isn’t the risk value by itself. For example, if you have an unpatched system (vulnerability) and an active exploit exists (threat), with critical data at stake, the risk is high because both the chance of exploitation and the potential damage are significant. Applying patches or other controls reduces either the likelihood or the impact, lowering the overall risk.

This concept centers on risk: it represents how likely it is that a threat will exploit a vulnerability and how severe the consequences would be if that happens. Risk is typically seen as the combination of probability and impact, often summarized as likelihood times impact. A threat is a potential danger or actor that could cause harm, but it isn’t itself a measure of how probable or damaging an event would be. A vulnerability is a weakness that could be exploited. An attack vector is the route or method used to exploit that vulnerability. Exposure describes how exposed the asset is to threats, which can influence risk but isn’t the risk value by itself.

For example, if you have an unpatched system (vulnerability) and an active exploit exists (threat), with critical data at stake, the risk is high because both the chance of exploitation and the potential damage are significant. Applying patches or other controls reduces either the likelihood or the impact, lowering the overall risk.