Study. uk . com
  1. Home
  2. All questions
  3. Question 292

CISM study material · question 292 of 1000

Which of these does IR 8286's definition of vulnerability include, alongside an unpatched software flaw?

  1. Only conditions present in software and firmware, since a vulnerability has to be something a threat can technically exploit
  2. Only conditions for which a control has already been defined, since an unmatched weakness cannot be tracked or treated
  3. Only conditions an automated scanner can detect, since the register has to be populated from evidence rather than from opinion
  4. A person susceptible to malicious persuasion, and a physical condition such as a flammable structure
Show the answer

Answer: D. A person susceptible to malicious persuasion, and a physical condition such as a flammable structure

IR 8286 defines a vulnerability simply as a condition that enables a threat event to occur — an unpatched software flaw, a configuration error, a person susceptible to malicious persuasion, or a physical condition such as flammability.

Source: NIST IR 8286 (NIST) — Sec. 3.2.3 Determination of Exploitable Conditions

Challenge yourself on this topic → Study as cards