Certified Ethical Hacker (CEH) Practice Question

In information security, risk is typically expressed as the combination of the likelihood that a threat will exploit a vulnerability and the magnitude of the resulting impact on the business. A vulnerability, by contrast, is simply a weakness that could be exploited; a threat is the potential cause of harm; and a safeguard or countermeasure is a control implemented to lower either the likelihood of exploitation or the severity of impact. Consequently, the definition that explicitly includes both likelihood (probability) and potential business damage most accurately captures the concept of risk.