RSM interview question

Vulnerability risk and threat differences?