1.7 Describe Terms as Defined in CVSS 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst is comparing two CVSS scores for the same vulnerability: the base score and the temporal score. The temporal score is lower than the base score. Which temporal metric value is most likely responsible?

   • AReport Confidence: Confirmed
   • BExploit Code Maturity: High
   • CAttack Complexity: High
   • DRemediation Level: Official Fix
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In CVSS, what does the Attack Complexity metric measure?

   • AThe number of steps required to exploit the vulnerability
   • BThe conditions beyond the attacker's control that must exist for the vulnerability to be exploited
   • CThe level of technical skill required by the attacker to write an exploit
   • DThe amount of time needed to develop a working exploit
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the purpose of CVSS environmental metrics?

   • ATo tailor the severity score to a specific organization's environment and requirements
   • BTo replace the base metrics with organization-specific values
   • CTo provide a global average score for a vulnerability
   • DTo calculate the financial impact of a vulnerability
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A critical vulnerability was disclosed two weeks ago. At the time of disclosure, no exploit code was publicly available, and the vendor had not released a patch. Today, a working exploit has been published, and the vendor has released an official patch. Which CVSS temporal metric values reflect the current state?

   • AExploit Code Maturity: Not Defined; Remediation Level: Official Fix
   • BExploit Code Maturity: High; Remediation Level: Official Fix
   • CExploit Code Maturity: Functional; Remediation Level: Unavailable
   • DExploit Code Maturity: Proof-of-Concept; Remediation Level: Workaround
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A vulnerability was scored with a CVSS base score of 9.0. A proof-of-concept exploit was published, but the vendor has not yet released a patch. The organization's security team is deciding whether to use the base score or the temporal score for prioritization. Which approach is most appropriate?

   • AUse the temporal score because it reflects the current exploitability and the lack of a patch, which is more relevant for prioritization.
   • BUse the base score because the temporal score is always lower.
   • CUse the base score because it is the same for all organizations and is more objective.
   • DUse the environmental score because it incorporates the organization's specific requirements.
   Reveal Solution Discussion Select an answer first