Developers often think of software quality in terms of faults and failures. Faults are problems, such as loops that never terminate or misplaced commas in statements, that developers can see by looking at the code. Failures are problems, such as a system crash or the invocation of the wrong function, that are visible to the user. Thus, faults can exist in programs but never become failures, because the conditions under which a fault becomes a failure are never reached. How do software vulnerabilities fit into this scheme of faults and failures? Is every fault a vulnerability? Is every vulnerability a fault?

Question

What will be an ideal response?

Answer 1

Vulnerabilities are both. Not every vulnerability will be visible to developers,since, for example, vulnerabilities may exist because of context of use. (For example, consider a program that displays warning messages about credit card authorization failures.
Displaying this information is nota vulnerability if only clerks can see the screen.)Not every fault that developers can see is a vulnerability; some faults might be in code that cannot be reached.