ISC2 CC Security Principles Practice Question
A security manager is conducting a risk assessment for a new cloud-based customer relationship management (CRM) system. The manager needs to identify which of the following are considered threats rather than vulnerabilities or risks. (Choose two.)
⚠ Common exam trap
The trap here is mixing up vulnerabilities and risks with threats; unpatched software and weak password policy are vulnerabilities, and financial loss is a risk, not a threat.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A hacker group known for targeting SaaS providers
In risk management, a threat is any actor or event with the potential to cause harm, such as a hacker group or a natural disaster. Vulnerabilities are weaknesses that can be exploited, like unpatched software or weak password policies. Risk is the potential for loss when a threat exploits a vulnerability. The question asks for threats, so the hacker group and natural disaster are correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Weak password policy allowing easy guessing
Why it's wrong here
A weak password policy is a vulnerability. It is an internal weakness that makes it easier for a threat actor to gain unauthorized access. While it increases risk, it is not a threat; it is a condition that a threat could exploit. The threat would be the attacker who guesses passwords.
- ✓
A hacker group known for targeting SaaS providers
Why this is correct
A hacker group is an external threat actor with the intent and capability to exploit vulnerabilities. In risk management, a threat is any circumstance or event with the potential to cause harm. This group represents a threat because it actively seeks to compromise systems, and its existence is independent of any specific weakness in the CRM.
- ✗
The potential financial loss from a data breach
Why it's wrong here
Potential financial loss is a risk, which is the combination of the probability of an event and its impact. It is not a threat; it is a consequence. In risk assessment, threats exploit vulnerabilities to cause risks. Financial loss is an outcome, not a source of harm.
- ✗
Unpatched software in the CRM application
Why it's wrong here
Unpatched software is a vulnerability, which is a weakness that can be exploited by a threat. It is not a threat itself; rather, it is a condition that a threat actor could take advantage of. In risk assessment, vulnerabilities are internal weaknesses, while threats are external or internal actors or events that can exploit them.
- ✓
A natural disaster causing data center outage
Why this is correct
A natural disaster is a threat because it is an event that can cause harm to assets. It is not a vulnerability; it is an external event that can exploit weaknesses (e.g., lack of redundancy). In risk assessment, natural disasters are categorized as threats, and their likelihood and impact are evaluated.
Go deeper
Related to this question
Learn chapter
Risk Management and Security Controls
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.