Which one of the following risk analysis terms characterizes the absence or weakness of a risk
reducing safegaurd?
A.
Threat
B.
Probability
C.
Vulnerability
D.
Loss expectancy
Explanation:
A weakness in system security procedures, system design, implementation, internal
controls, and so on that could be exploited to violate system security policy. -Ronald Krutz The CISSP
PREP Guide (gold edition) pg 927