easyMultiple Choice
SSCP Practice Question: In the context of risk assessment, which of the…
In the context of risk assessment, which of the following best describes a vulnerability?
⚠ Common exam trap
Test-takers frequently confuse 'vulnerability' with 'threat' (Option A) or 'risk' (Option B), because risk assessment terminology is often used interchangeably in casual conversation, but the SSCP exam strictly defines vulnerability as a weakness, not the event or likelihood.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A weakness in a system that can be exploited
In risk assessment, a vulnerability is specifically a weakness in a system, application, or process that can be exploited by a threat. Option D correctly defines this as a weakness that can be exploited, which aligns with the NIST SP 800-30 definition of vulnerability as a flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system’s security policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A potential event that can cause harm
Why it's wrong here
A potential event causing harm defines a threat, not a vulnerability; a vulnerability is the weakness itself that a threat could exploit. It tempts because threats and vulnerabilities are paired in risk equations, so listing harmful events feels relevant, but threat identification is the correct activity when enumerating possible adverse occurrences.
- ✗
The likelihood of a threat exploiting a weakness
Why it's wrong here
Likelihood of exploitation describes risk or probability, not the weakness itself; a vulnerability is the flaw an attacker could leverage. It tempts because risk assessment quantifies likelihood, so this phrasing sounds central, but probability estimation belongs to risk analysis, not vulnerability definition.
- ✗
An actual occurrence of a harmful event
Why it's wrong here
A vulnerability is a weakness or gap that a threat could exploit; an actual occurrence of a harmful event is an incident, or a realised risk. It is tempting because incidents often reveal vulnerabilities, but occurrence describes the event itself, not the exploitable weakness.
- ✓
A weakness in a system that can be exploited
Why this is correct
A vulnerability is an exploitable weakness in a system, such as a missing patch, misconfiguration or flawed code. It differs from a threat, which is the actor or event that could exploit it, and from risk, which combines likelihood and impact. This matches the stem's risk assessment context.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.