What best describes a vulnerability in information security?

What best describes a vulnerability in information security?

• A. An exploitable program.
• B. A weakness in the design or implementation that can be exploited.
• C. A detection method.
• D. A routine backup process.

Answer: (B)

A vulnerability is a weakness in the design or implementation that could be exploited to compromise security. This makes sense because flaws in how a system is built or configured — like a software bug, an insecure default setting, or a missed patch — create openings an attacker could use to gain unauthorized access or disrupt services. An exploitable program, while related, describes the tool or method an attacker might use to take advantage of such a flaw rather than the flaw itself. A detection method is focused on finding vulnerabilities, not describing the weakness. A routine backup process is a protective measure for recovery, not a vulnerability. Understanding vulnerabilities helps you prioritize fixes such as patches or configuration changes to reduce risk.

A vulnerability is a weakness in the design or implementation that could be exploited to compromise security. This makes sense because flaws in how a system is built or configured — like a software bug, an insecure default setting, or a missed patch — create openings an attacker could use to gain unauthorized access or disrupt services. An exploitable program, while related, describes the tool or method an attacker might use to take advantage of such a flaw rather than the flaw itself. A detection method is focused on finding vulnerabilities, not describing the weakness. A routine backup process is a protective measure for recovery, not a vulnerability. Understanding vulnerabilities helps you prioritize fixes such as patches or configuration changes to reduce risk.