Which sentence best defines risk in IT security?

• A. A risk is something bad that could happen if threat happens because the vulnerability is exploited
• B. A risk is the probability of a false positive
• C. A risk is the time to recover from an incident
• D. A risk is the cost of hardware

Answer: (A)

Risk in IT security is the potential for loss, damage, or disruption that could occur when a threat exploits a vulnerability. It reflects both how likely the harmful event is and how severe the impact would be, often framed as probability times impact. This matches the idea that risk is something bad that could happen if a threat takes advantage of a vulnerability. The other ideas describe different concepts: false positives relate to detecting benign events as threats; recovery time measures how long it takes to restore operations after an incident; and hardware cost concerns the price of equipment rather than the risk of harm from threats.