Security Management: Week 1 - Threat, risk, vulnerability, impact Question and answers verified to pass 2025/2026

Security Management: Week 1 - Threat, risk, vulnerability,
impact Question and answers verified to pass 2025/2026

An entity who can manifest a treat. Can be internal or
external to organisation or network
1.Threat Agent
2.Threat Potential cause of incident that may harm organisation or
system
e.g. Malware, Natural Disasters
3. Vulnerability A vulnerability is a weakness of an asset or a group of assets that can be
exploited by one or more threats (ISO 27002).
This may be in a procedure, hardware or software.

4. Risk A risk is the potential that a given threat will exploit vulnerabilities of an
asset or a group of assets and thereby cause harm to the organisation
(ISO 27002).

We could also view this as the likelihood of a threat agent taking advantage
of a vulnerability and the resultant impact to the organisation's assets.

5. Impact The impact is the result of a risk materialising, caused by a threat, which
attects assets (ISO 27005).

In other words, if the asset is exploited, what is the real cost to the
organisation?

6. Safeguard Also known as risk treatment action, safeguards can be used to
mitigate, transfer or remove the threat altogether.

7. Relationship
of Terms 9.


8. Where do
threats come
from?


1/
3