Which element describes the probability that a threat will exploit a vulnerability?

• A. Impact
• B. Likelihood
• C. Threats
• D. Consequences

Answer: (B)

Probability that a threat will exploit a vulnerability is described by likelihood. This measures how probably it is that a given weakness will be taken advantage of, considering factors like exploit availability, attacker motivation, exposure, and existing controls. It’s a forward-looking estimate of the chance an incident will occur, not how severe it would be or who might cause it.

Impact describes how bad the outcome would be if exploitation happens, not how likely it is. Threats are the potential sources of harm, such as attackers or natural events, rather than the chance of exploitation. Consequences refer to the actual damage or losses that result from an incident, again focusing on the outcome rather than the probability. So likelihood best captures the probability of exploitation.