Which of the following does a lack of adequate security controls represent?

Which of the following does a lack of adequate security controls represent?
A . Asset
B . Vulnerability
C . Impact
D . Threat

Answer: B

Explanation:

A lack of adequate security controls represents a vulnerability, which is a weakness or flaw in an asset or its protection that can be exploited by a threat. A vulnerability can increase the likelihood or impact of a security incident, and therefore should be identified and treated as part of the risk management process. ISO/IEC 27001:2022 defines vulnerability as “the absence or weakness of a safeguard that could be exploited by a threat source” (see clause 3.49).

Reference: [CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course], ISO/IEC 27001:2022 Information technology ― Security techniques ― Information security management systems ― Requirements