ISC2 CC Security Principles Practice Question
A security team identifies that a server has a known vulnerability. A threat actor could exploit it to gain unauthorized access. The combination of these factors represents:
⚠ Common exam trap
CC often tests the distinction between threat, vulnerability, and risk, so candidates might choose 'vulnerability' or 'threat' instead of recognizing that the combination is risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk
Risk is the combination of a threat exploiting a vulnerability, potentially leading to harm. Here, a threat actor could exploit a known vulnerability to gain unauthorized access, which represents a risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Threat
Why it's wrong here
A threat is only the actor or event with potential to cause harm; the stem combines that actor with an existing weakness and exploit path, which is risk. Threat alone would be correct if the question described only the malicious actor, without the server vulnerability.
- ✓
Risk
Why this is correct
Risk is the combination of a vulnerability (the known server flaw), a threat (the actor who could exploit it) and the resulting potential for loss. Neither element alone constitutes risk; their pairing with impact is what the stem describes, making risk the accurate term rather than vulnerability or threat in isolation.
- ✗
Control
Why it's wrong here
A control is a safeguard that mitigates risk, whereas the stem describes an exploitable weakness paired with a threat actor, which is risk. Control would be correct if the question asked what measure reduces the likelihood or impact of that exploitation.
- ✗
Vulnerability
Why it's wrong here
A vulnerability alone is only the weakness; the stem describes vulnerability plus threat actor plus exploitability, which together constitute risk. Vulnerability would be the answer if the question asked solely about the server flaw itself, absent any actor or likelihood of exploitation.
Go deeper
Related to this question
Learn chapter
Risk Management and Security Controls
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.