Which statement most accurately describes vulnerability?

Which statement most accurately describes vulnerability?

• A. Intrinsic properties of something that create susceptibility to risk that can lead to a consequence
• B. A threat actor actively exploiting systems
• C. A control designed to prevent loss
• D. A residual risk after remediation

Answer: (A)

Vulnerability is about inherent weaknesses that make an asset susceptible to harm. It focuses on the system’s own properties—design, configuration, or operation—that create a chance for risk to be realized, potentially leading to a consequence if exploited. This makes the described idea the most accurate: intrinsic properties that create susceptibility to risk that can lead to a consequence. An active attacker exploiting systems is about the threat event itself, not the weakness that enables it. A control designed to prevent loss is a safeguard or countermeasure, not the vulnerability. A residual risk after remediation refers to risk that remains after controls are in place, not the underlying weakness itself. For example, an unpatched software flaw is a vulnerability that could be exploited, and applying a patch addresses that vulnerability, though other weaknesses might still exist.

Vulnerability is about inherent weaknesses that make an asset susceptible to harm. It focuses on the system’s own properties—design, configuration, or operation—that create a chance for risk to be realized, potentially leading to a consequence if exploited. This makes the described idea the most accurate: intrinsic properties that create susceptibility to risk that can lead to a consequence.

An active attacker exploiting systems is about the threat event itself, not the weakness that enables it. A control designed to prevent loss is a safeguard or countermeasure, not the vulnerability. A residual risk after remediation refers to risk that remains after controls are in place, not the underlying weakness itself. For example, an unpatched software flaw is a vulnerability that could be exploited, and applying a patch addresses that vulnerability, though other weaknesses might still exist.