1.7 Describe Terms as Defined in CVSS 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A vulnerability in a customer-facing web application has a base CVSS score of 7.5. The application stores sensitive customer data, and the organization has a regulatory requirement that prioritizes confidentiality over availability. Which environmental metric adjustment would best reflect this organization's priorities?

   • ASet all environmental requirements to High
   • BSet Integrity Requirement to High and Confidentiality Requirement to Low
   • CSet Confidentiality Requirement to High and Availability Requirement to Low
   • DLeave all environmental metrics as Not Defined
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In CVSS, which attack vector value indicates that the attacker must have physical access to the target system?

   • AAdjacent
   • BPhysical
   • CLocal
   • DNetwork
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is an example of a CVSS environmental metric?

   • AExploit code maturity
   • BConfidentiality requirement
   • CAttack complexity
   • DUser interaction
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which statement best describes the role of CVSS in vulnerability management?

   • AIt is a proprietary tool that only works with Cisco products
   • BIt automatically calculates the financial cost of a vulnerability to an organization
   • CIt provides a repeatable framework for scoring vulnerability severity that can be used to prioritize remediation
   • DIt guarantees that all vulnerabilities with the same score have the same real-world impact
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   A vulnerability in a web application allows an attacker to access data stored in a separate database server that is managed by a different security authority. How does this affect the CVSS Scope metric?

   • AThe scope is unchanged because the attacker is still using the same network
   • BThe scope is unchanged because the web application and database are part of the same system
   • CThe scope is not applicable because the database is not directly vulnerable
   • DThe scope is changed because the impact extends beyond the vulnerable component's security authority
   Reveal Solution Discussion Select an answer first