The magnitude of loss resulting from a threat exploiting a vulnerability is referred to as what?

• A. Consequence
• B. Control
• C. Attack
• D. Audit

Answer: (A)

The main idea is that when a threat takes advantage of a vulnerability, the outcome in terms of what is lost or damaged is the consequence (impact). It describes how severe the loss would be—financial costs, downtime, data loss, reputational damage, or regulatory penalties—if that exploit occurs. This is different from a control, which is something put in place to reduce risk; and it’s different from an attack, which is the actual event, or an audit, which assesses controls and compliance. In risk analysis, you consider both how likely the threat is and how severe the resulting loss would be. So, the magnitude of loss from a threat exploiting a vulnerability is the consequence.