What best describes the purpose of a security vulnerability assessment (SVA)?

• A. An audit of financial controls for security expenses.
• B. A structured evaluation of facilities to identify weaknesses that could be exploited and to recommend mitigations.
• C. A survey of employees' security awareness.
• D. A risk assessment focused only on cyber threats.

Answer: (B)

A security vulnerability assessment aims to systematically uncover weaknesses in security controls that could be exploited and to propose mitigations. It’s a structured evaluation of facilities and security-related processes to identify gaps—physical, procedural, or operational—and to prioritize fixes based on how likely they are to be exploited and the potential impact. This goes beyond just auditing financial controls, surveying people’s security awareness, or focusing only on cyber threats; it specifically targets weaknesses that grant an attacker access or cause harm, with recommended measures to reduce that risk.