The following statements regarding risks, threats, and vulnerabilities are true, except:

A$.$ lax physical security measures are vulnerabilities because they allow attackers to gain access to a system.

B$.$ it does not make sense to devote excessive resources to mitigating a vulnerability that has a very low probability of occurrence while ignoring a vulnerability with a much higher probability.

C$.$ risks occur when there is the potential that a particular threat will exploit a vulnerability, causing harm to an organization.

D$.$ IT professionals put controls in place to increase both the probability and impact of a risk.