Study. uk . com
  1. Home
  2. All questions
  3. Question 293

CISM study material · question 293 of 1000

An analyst records a serious vulnerability for which no credible threat exists in the organisation's environment. Which two points does IR 8286 make? Choose two.

  1. A vulnerability causes no harm by itself, since a threat must be present to exploit it
  2. Threat and vulnerability are two names for the same factor
  3. Every vulnerability must be treated regardless of threat
  4. A threat with no corresponding vulnerability may not result in negative risk
Show the answer

Answer: A. A vulnerability causes no harm by itself, since a threat must be present to exploit it
D. A threat with no corresponding vulnerability may not result in negative risk

IR 8286 states the presence of a vulnerability does not cause harm in itself, as a threat must be present to exploit it, and that a threat without a corresponding vulnerability may not result in a negative risk.

Source: NIST IR 8286 (NIST) — Sec. 3.2.3 Determination of Exploitable Conditions

Challenge yourself on this topic → Study as cards