A weakness or lack of a safeguard, which may be exploited by a threat, causing harm to the information
systems or networks is called:

A.
a vulnerability.

B.
a risk.

C.
a threat.

D.
an overflow.

Explanation:
A vulnerability is defined as “the absence or weakness of a safeguard that could be exploited”.
A vulnerability is a lack of a countermeasure or a weakness in a countermeasure that is in place. It can be a
software, hardware, procedural, or human weakness that can be exploited. A vulnerability may be a service
running on a server, unpatched applications or operating systems, an unrestricted wireless access point, an
open port on a firewall, lax physical security that allows anyone to enter a server room, or unenforced password
management on servers and workstations.
Incorrect Answers:
B: A risk is the likelihood of a threat agent exploiting a vulnerability and the corresponding business impact.C: A threat is any potential danger that is associated with the exploitation of a vulnerability.
D: An overflow is not what is described in this question.

Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 26