In risk management, vulnerability is best described as:

In risk management, vulnerability is best described as:

• A. External threat
• B. Intrinsic properties that create susceptibility to risk
• C. A specific security control
• D. A remediation action

Answer: (B)

Vulnerability means inherent weaknesses that make an asset, system, or process susceptible to harm. It’s about the conditions inside the asset that allow threats to cause damage, not the threat itself or the protective measures. A vulnerability is what a threat can exploit—think of unpatched software, weak configurations, or gaps in procedures. When such weaknesses exist, the risk rises because a threat has a feasible path to cause impact. The other options describe things that aren’t vulnerabilities: an external threat is the attacker or event; a security control is a safeguard; a remediation action is how you fix the weakness.

Vulnerability means inherent weaknesses that make an asset, system, or process susceptible to harm. It’s about the conditions inside the asset that allow threats to cause damage, not the threat itself or the protective measures. A vulnerability is what a threat can exploit—think of unpatched software, weak configurations, or gaps in procedures. When such weaknesses exist, the risk rises because a threat has a feasible path to cause impact. The other options describe things that aren’t vulnerabilities: an external threat is the attacker or event; a security control is a safeguard; a remediation action is how you fix the weakness.