The probability that a threat-source will exploit a vulnerability.

The probability that a threat-source will exploit a vulnerability.

• A. Likelihood
• B. Impact
• C. Risk
• D. Severity

Answer: (A)

This item tests how we distinguish probability of exploitation from impact and from overall risk. The probability that a threat-source will exploit a vulnerability is called likelihood. It focuses on how likely the exploitation is to occur, given factors like attacker capability, exploit availability, and controls in place. Impact, on the other hand, describes the consequences if exploitation happens—how severe the effect would be on assets or operations. Risk is the overall measure that combines both likelihood and impact (often modeled as risk = likelihood × impact). Severity is typically a measure of how serious the consequences are, and can be tied to impact, but it doesn’t describe the probability itself. So the best answer for the probability of exploitation is likelihood.

This item tests how we distinguish probability of exploitation from impact and from overall risk. The probability that a threat-source will exploit a vulnerability is called likelihood. It focuses on how likely the exploitation is to occur, given factors like attacker capability, exploit availability, and controls in place. Impact, on the other hand, describes the consequences if exploitation happens—how severe the effect would be on assets or operations. Risk is the overall measure that combines both likelihood and impact (often modeled as risk = likelihood × impact). Severity is typically a measure of how serious the consequences are, and can be tied to impact, but it doesn’t describe the probability itself. So the best answer for the probability of exploitation is likelihood.