200-201 Security Concepts Practice Question
Which of the following best describes the relationship between a vulnerability, threat, and risk in cybersecurity?
⚠ Common exam trap
Cisco often tests the precise definitions of vulnerability, threat, and risk, and the trap here is confusing the terms (e.g., thinking a vulnerability is a threat or that risk disappears after patching) rather than recognizing the causal chain where a threat exploits a vulnerability to create risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A threat exploits a vulnerability, resulting in risk.
In cybersecurity, a threat (e.g., an attacker) exploits a vulnerability (e.g., an unpatched software flaw) to cause harm, and the likelihood and impact of that exploitation constitute risk. This aligns with the NIST SP 800-30 definition: risk is a function of the likelihood of a threat exploiting a vulnerability and the resulting impact. Without the exploitation of a vulnerability by a threat, there is no risk to the asset.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A vulnerability is a potential danger; a threat is a weakness; risk is the impact.
Why it's wrong here
This reverses the definitions.
- ✗
A vulnerability is a potential attack; a threat is a weakness.
Why it's wrong here
Incorrect definitions.
- ✗
Risk is eliminated when a vulnerability is patched.
Why it's wrong here
Risk can be reduced but not always eliminated entirely.
- ✓
A threat exploits a vulnerability, resulting in risk.
Why this is correct
Risk = likelihood of threat exploiting vulnerability * impact.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.