Which of the following are control conditions that exist in IT systems and may be exploited by an attacker?

Vulnerabilities are weaknesses, flaws, or gaps in security controls, system design, implementation, or internal processes. These conditions, when present in IT systems, can be exploited by a threat or threat agent to cause harm or gain unauthorized access to an asset. The question's phrasing, "control conditions that exist in IT systems and may be exploited," is a direct definition of a vulnerability.

A. Cybersecurity risk scenarios describe a potential event, combining a threat actor, a vulnerability, and an impact; they are not the condition itself.
C. Threats are the agents or events (e.g., a hacker, malware) that can exploit a vulnerability, not the weakness itself.

1. ISACA. (2020). IT Risk Fundamentals Study Guide, 2nd Edition. Glossary and Section 1.2.1, "Risk Factors," define a vulnerability as a weakness or flaw that can be exploited by a threat.

2. National Institute of Standards and Technology. (2021). Risk Management Framework for Information Systems and Organizations (NIST Special Publication 800-37 Rev. 2). Glossary, Appendix F, defines vulnerability as a "weakness in an information system...that could be exploited by a threat source."