Which option best defines a vulnerability?

• A. A delay in processing
• B. An action taken to reduce risk
• C. A weakness in design or implementation
• D. A performance metric

Answer: (C)

A vulnerability is a flaw in how a system is designed, implemented, or configured that can be exploited by an attacker. It represents a weakness that could allow unauthorized access, disclosure, modification, or disruption if left unaddressed. This is different from a delay in processing, which is a performance issue, a mitigation action taken to reduce risk, which is a control, or a performance metric, which is a measurement. For example, unpatched software with a known flaw or weak input validation creates a vulnerability because it could be exploited to compromise the system.