Câu 36: Lead Auditor: ISO/IEC 27001 Lead Auditor

Which of the following statements regarding threats and vulnerabilities in information security is NOT correct?

1. A. Vulnerabilities can be intrinsic or extrinsic, related to the characteristics of the asset or to external factors
2. B. Threats must exploit a vulnerability to have a negative impact on the confidentiality, integrity, and/or availability of information
3. C. All vulnerabilities require immediate implementation of controls regardless of corresponding threats — đáp án hiện tại