A public-facing server has a known vulnerability, but there is no evidence of exploitation or unauthorized activity. What is the most accurate classification based on the course material?

### Why this is right A vulnerability is a weakness that could be exploited. Without evidence of exploitation, unauthorized activity, or resulting harm, it is not automatically a confirmed incident. Its exposure and potential impact still require assessment and mitigation. ### The concept Risk depends on more than the existence of a flaw. Analysts consider whether a credible threat can reach it, whether exploitation is active, what assets and data are involved, and what controls limit impact. An internet-facing, business-critical server may deserve urgent attention, but prioritization is a risk decision rather than proof that compromise occurred. ### The other options - **B. A confirmed data breach**: No unauthorized access or disclosure is established. - **C. A completed eradication**: No incident cause has been removed in the scenario. - **D. A post-incident review**: This follows incident handling and evaluates lessons learned. ### Terms - **Vulnerability**: A weakness that may be exploited. - **Risk**: The potential for harm, informed by likelihood and impact. ### Remember A weakness creates exposure; evidence of exploitation or likely harm may trigger incident handling.