1.7 Describe Terms as Defined in CVSS 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A vulnerability in a widely used library was disclosed with a proof-of-concept exploit. The vendor has not yet released a patch, but a third-party workaround is available. The security team at a company that uses this library needs to decide how to prioritize remediation. Which CVSS temporal metric values should they use?

   • AExploit Code Maturity: High; Remediation Level: Unavailable
   • BExploit Code Maturity: Proof-of-Concept; Remediation Level: Workaround
   • CExploit Code Maturity: Not Defined; Remediation Level: Workaround
   • DExploit Code Maturity: Functional; Remediation Level: Official Fix
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What does the CVSS Scope metric describe?

   • AThe physical area that an attacker can access
   • BThe range of CVSS scores that apply to a vulnerability
   • CWhether a vulnerability in one component can impact resources beyond its security authority
   • DThe number of systems that are vulnerable to the same issue
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   How do temporal metrics affect a CVSS score?

   • AThey are used only for vulnerabilities that have been patched
   • BThey replace the base metrics entirely
   • CThey only affect the confidentiality impact
   • DThey adjust the base score based on the current exploitability and availability of fixes
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A hospital is assessing a vulnerability in a medical device that stores patient health records. The device is isolated from the internet but accessible on the internal network. The hospital's security team wants to prioritize based on the organization's specific environment. Which CVSS metric group should they customize?

   • AAttack Vector metric, because the device is isolated from the internet.
   • BEnvironmental metrics, because they allow tailoring the score to the organization's confidentiality requirements and modified attack vector.
   • CTemporal metrics, because they reflect the current availability of exploits and patches.
   • DBase metrics, because they define the intrinsic characteristics of the vulnerability.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is reviewing a CVSS vector for a vulnerability in an email client. The vector indicates User Interaction: Required. Which scenario best matches this metric?

   • AAn attacker sends a crafted email that the recipient must open and click a link to trigger the exploit.
   • BAn attacker must first authenticate to the email server before sending the malicious email.
   • CAn attacker exploits the vulnerability automatically when the email client checks for new messages.
   • DThe email client must be running on a network adjacent to the attacker's machine.
   Reveal Solution Discussion Select an answer first