B is correct. Statistical checks over a period of time to see if it adheres to certain trends. Rulebased just checks for this specific moment.

Risk is the likelihood ./threat potential danger

Correct answer: B. ARP cache poisoning

DHCP snooping is a counter measure against attack.

wiki:

In computer networking, ARP spoofing, ARP cache poisoning, or ARP poison routing, is a technique by which an attacker sends (spoofed) Address Resolution Protocol (ARP) messages onto a local area network. Generally, the aim is to associate the attacker's MAC address with the IP address of another host, such as the default gateway, causing any traffic meant for that IP address to be sent to the attacker instead.

"A port scanner is an application designed to probe a server or host for open ports. Such an application may be used by administrators to verify security policies of their networks and by attackers to identify network services running on a host and exploit vulnerabilities."

source: https://en.wikipedia.org/wiki/Port_scanner

So B is the correct answer

"Vulnerability management is the "cyclical practice of identifying, classifying, prioritizing, remediating, and mitigating" software vulnerabilities.[1] Vulnerability management is integral to computer security and network security, and must not be confused with Vulnerability assessment"

source: https://en.wikipedia.org/wiki/Vulnerability_management

So A is the correct answer

Threat agent and Threat actor are the same (see https://itlaw.wikia.org/wiki/Threat_agent)

And the threat actor is the organization/person performing the attack. (https://orangematter.solarwinds.com/2018/07/18/cybersecurity-fundamentals-threat-and-attack-terminology/)

So D is the correct answer

See also: https://www.ciscopress.com/articles/article.asp?p=2783637

A is the correct answer

"Privileges Required

The metric values of High, Low, and None reflect the privileges required by an attacker to exploit the vulnerability. The higher the privileges required, the lower the overall severity."

Source: https://tools.cisco.com/security/center/resources/understanding-terminology.html#exploitability

So A is the right answer

Correct Answer: C

The attack surface of a software environment is the sum of the different points (for "attack vectors") where an unauthorized user (the "attacker") can try to enter data to or extract data from an environment.[1][2] Keeping the attack surface as small as possible is a basic security measure.[3]

https://en.wikipedia.org/wiki/Attack_surface

In computer security, an attack vector is a specific path, method, or scenario that can be exploited to break into an IT system, thus compromising its security. The term was derived from the corresponding notion of vector in biology. An attack vector may be exploited manually, automatically, or through a combination of manual and automatic activity.

https://en.wikipedia.org/wiki/Attack_vector

Correct answer is A

"2.3.2. Integrity (I)

This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. The Base Score is greatest when the consequence to the impacted component is highest."

source: https://www.first.org/cvss/specification-document