FC0-U71 Security Practice Question
Which of the following is a key difference between a vulnerability and a threat in cybersecurity?
⚠ Common exam trap
FC0-U71 often tests the vulnerability/threat definition swap; the trap is picking the option that sounds comprehensive (like 'always present' or 'cannot be mitigated') instead of the precise weakness-versus-danger distinction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A vulnerability is a weakness, while a threat is a potential danger
A vulnerability is a weakness or flaw in a system (e.g., unpatched software, misconfiguration) that could be exploited, while a threat is any potential danger or actor that could exploit that weakness (e.g., a hacker, malware, or natural disaster). Option C correctly captures this weakness-versus-danger distinction. Understanding the difference is essential for risk assessment, since risk = threat × vulnerability × impact.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A vulnerability is a potential harm, while a threat is a weakness
Why it's wrong here
A vulnerability is a weakness exploitable by an attacker, whereas a threat is any actor or event capable of causing harm; this option reverses those definitions. It tempts because both concepts feature in risk assessment, and pairing "potential harm" with "threat" sounds intuitive. Threat modelling, not vulnerability scanning, addresses hostile actors.
- ✗
A vulnerability is always present, while a threat is actively exploited
Why it's wrong here
A vulnerability is a weakness that may or may not be present in a given system, and a threat is any circumstance or actor with potential to cause harm; exploitation is a separate event. This option misstates both definitions, confusing inherent weakness with realised attack.
- ✓
A vulnerability is a weakness, while a threat is a potential danger
Why this is correct
A vulnerability is an exploitable weakness in a system, whereas a threat is any potential danger or actor that could exploit it. This axis of difference satisfies the stem directly: the weakness versus the danger, not the likelihood or impact of either.
- ✗
A vulnerability can be patched, but a threat cannot be mitigated
Why it's wrong here
Threats can be mitigated through controls such as firewalls, patching exposure, or segmentation; the axis separating vulnerability from threat is that a vulnerability is a weakness in an asset, whereas a threat is any actor or event that could exploit it. Patching is one remediation, not the defining distinction.
Go deeper
Related to this question
About these practice questions
This FC0-U71 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This FC0-U71 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the FC0-U71 exam.