N10-009 Question 256
Single answerCommon security terminology: Risk, Vulnerability, Exploit, Threat, Confidentiality, Integrity, and Availability (CIA) triadA hospital's IT team discovers that a public-facing patient portal is running an outdated web application framework with a known remote code execution bug. Shortly afterward, attackers use publicly available code to gain access and modify several patient appointment records, although the portal remains online. Which term BEST describes the outdated framework in this scenario?
- A
Threat
- B
Exploit
- C
Vulnerability
- D
Availability issue
Show answer and explanation
Correct answer: C
Explanation
The best answer is vulnerability. In common security terminology, a vulnerability is a weakness in software, hardware, configuration, or process that can be exploited by a threat actor. Here, the outdated framework with a known remote code execution flaw is the vulnerability. The attackers represent the threat, and the publicly available code they used is the exploit. Because records were modified without authorization, the affected element of the CIA triad is integrity, not availability. This terminology aligns with standard security guidance such as NIST definitions, which distinguish threats, vulnerabilities, and exploits, and with general industry best practices that emphasize patching known software flaws to reduce organizational risk.
- A. Incorrect.
Incorrect. A threat is a potential cause of harm, such as a threat actor, malware, or a natural disaster. In this scenario, the attackers are part of the threat, but the outdated framework itself is not the threat.
- B. Incorrect.
Incorrect. An exploit is the method, code, or technique used to take advantage of a weakness. The publicly available code used by the attackers is the exploit, not the outdated framework.
- C. Correct.
Correct. A vulnerability is a weakness that could be exploited by a threat. The outdated web application framework with a known remote code execution bug is the weakness that enabled compromise.
- D. Incorrect.
Incorrect. Availability refers to systems and data being accessible when needed. The scenario states that the portal remained online, so availability was not the primary issue. The unauthorized modification of appointment records is more closely related to integrity.