Security+ topic 2.1
Threat and Vulnerability Characteristics
A threat is anything that could cause harm, a vulnerability is a weakness it could use, and risk is the chance and cost of that happening, so teams judge each threat by its likelihood and impact. Threat intelligence is knowledge about threats organized so it can be acted on. It comes from open-source reports (OSINT), paid vendor feeds, government advisories, industry sharing groups (ISACs), dark web monitoring, and your own logs, which are the only source that shows what is happening to you. Known vulnerabilities get a CVE identifier and a CVSS score from 0 to 10, but the score alone does not set priority: how exposed and how important the system is matter too.
Threat and Vulnerability Characteristics vocabulary
- Threat: Anything that could exploit a vulnerability and cause harm.
- Threat intelligence: Information about threats and attackers, organized so a team can act on it.
- ISAC: Information Sharing and Analysis Center: a group where organizations in one sector share threat information.
- CVSS: Common Vulnerability Scoring System: a 0 to 10 score of how severe a vulnerability is.
Exam-style practice questions
Try each one, then open the answer. To save your progress, take this quiz in the interactive course.
1. A security team rates each threat by how likely it is to happen and how much damage it would cause. What is the team measuring?
- (A) Risk
- (B) Non-repudiation
- (C) Attack surface
- (D) Availability
Show answer
(A) Risk Risk combines likelihood and impact.
2. Which of the following threat intelligence sources is the only one that shows what is actually happening inside the organization?
- (A) Government advisories
- (B) Internal logs and alerts
- (C) Open-source news reports
- (D) Dark web monitoring
Show answer
(B) Internal logs and alerts External sources give context; internal telemetry is the ground truth for your own network.
3. A hospital joins a group where hospitals share the attacks they see with each other. Which of the following has it joined?
- (A) An ISAC
- (B) A CAB
- (C) A SIEM
- (D) A screened subnet
Show answer
(A) An ISAC An Information Sharing and Analysis Center shares threat information within one sector.
Vulnerability A has a CVSS score of 9.8 on an isolated test server with no data. Vulnerability B has a score of 7.5 on the internet-facing payment server.
4. Which of the following should the team fix first?
- (A) Vulnerability A, because its score is higher
- (B) Vulnerability B, because the system is exposed and critical to the business
- (C) Neither, because both are below 10
- (D) Both at the same time next year
Show answer
(B) Vulnerability B, because the system is exposed and critical to the business CVSS rates severity, but exposure and business importance decide priority.