A weakness in an unpatched application is best classified as a:

### Why this is right A vulnerability is a weakness that a threat may exploit. An unpatched application is a weakness in a system. ### The concept Risk arises when a threat can exploit a vulnerability and cause an impact; the weakness itself is not the threat or the resulting incident. ### The other options - **A. Threat**: a possible cause of harm, such as an attacker or harmful event. - **C. Residual risk**: risk remaining after controls are applied. - **D. Incident response policy**: a governance document, not a system weakness. ### Remember Threat acts, vulnerability exposes, impact results.