What is the difference between a risk assessment and a vulnerability assessment?

Question

Options

• AA risk assessment and a vulnerability assessment are the same thing.
• BA risk assessment and a vulnerability assessment are both methods of testing the effectiveness
• CA risk assessment evaluates the potential impact of threats, while a vulnerability assessment
• DA risk assessment identifies specific vulnerabilities, while a vulnerability assessment evaluates

• A
  4% (2)
• B
  4% (2)
• C
  86% (49)
• D
  7% (4)

Explanation

These two assessments serve different but complementary purposes. A vulnerability assessment identifies and catalogs specific weaknesses in systems, applications, or configurations (e.g., unpatched software, misconfigured services). A risk assessment goes broader: it evaluates the likelihood and potential business impact of threats exploiting those vulnerabilities, factoring in asset value and existing controls to prioritize remediation. They are not the same thing, nor are they both methods of testing effectiveness (that describes penetration testing). The answer in option D has the definitions reversed.

No community discussion yet for this question.