easyMultiple ChoiceObjective-mapped
SSCP Practice Question: In the context of risk assessment, which of the…
In the context of risk assessment, which of the following best describes a vulnerability?
⚠ Common exam trap
Test-takers frequently confuse 'vulnerability' with 'threat' (Option A) or 'risk' (Option B), because risk assessment terminology is often used interchangeably in casual conversation, but the SSCP exam strictly defines vulnerability as a weakness, not the event or likelihood.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A weakness in a system that can be exploited
In risk assessment, a vulnerability is specifically a weakness in a system, application, or process that can be exploited by a threat. Option D correctly defines this as a weakness that can be exploited, which aligns with the NIST SP 800-30 definition of vulnerability as a flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system’s security policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A potential event that can cause harm
Why it's wrong here
This defines a threat, not vulnerability.
- ✗
The likelihood of a threat exploiting a weakness
Why it's wrong here
This describes risk.
- ✗
An actual occurrence of a harmful event
Why it's wrong here
This describes an incident.
- ✓
A weakness in a system that can be exploited
Why this is correct
Correct definition.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.