For a semester exam, which option is correct about vulnerability?

A. a secure configuration baseline B. a weakness that can be exploited to harm security C. a completed user story D. an approved security control