Which term describes the magnitude of loss from a threat exploiting a vulnerability?

• A. Attack
• B. Consequence
• C. Audit
• D. Control

Answer: (B)

The magnitude of loss from a threat exploiting a vulnerability is the consequence. This describes the impact or damage that results from the risk event—such as financial costs, downtime, data loss, or reputational harm. The other terms don’t measure that damage: an attack is the act of exploiting, an audit is a review to assess controls, and a control is a safeguard put in place to reduce risk. In risk modeling, risk is often viewed as the combination of how likely the event is and how severe the impact would be, which is captured by the consequence. For example, a breach that could lead to millions in fines and remediation represents a large consequence.