1.7 Describe Terms as Defined in CVSS 200-201 Practice Questions (Page 5)

Questions 21–24

1. 21foundation · easy

   In CVSS, what does the User Interaction metric indicate?

   • AThe number of users affected by the vulnerability
   • BThe level of interaction the attacker has with the target system
   • CWhether exploitation requires action from a user other than the attacker
   • DThe amount of user data that is exposed during exploitation
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary purpose of the Common Vulnerability Scoring System (CVSS)?

   • ATo provide a legal framework for reporting vulnerabilities to regulators
   • BTo provide a standardized method for rating the severity of security vulnerabilities
   • CTo automatically patch vulnerabilities once they are discovered
   • DTo replace the need for vulnerability scanning tools
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A vulnerability exists in a web server plugin that runs with the privileges of the web server process. Exploitation allows the attacker to execute commands with the web server's privileges, but the plugin runs in a sandbox that prevents access to other applications on the host. Which CVSS Scope value is most appropriate?

   • AScope: High
   • BScope: Not Defined
   • CScope: Unchanged
   • DScope: Changed
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A vulnerability in a web application has a base score of 6.5. The application is used by a hospital to store patient records, and the hospital has a high confidentiality requirement. The vulnerability can be exploited remotely, but the hospital's application is only accessible on the internal network. Which CVSS score should the hospital use for prioritization?

   • AThe base score, because it is the standard score used by all organizations.
   • BThe temporal score, because it reflects the current exploit code maturity.
   • CThe environmental score, because it adjusts for the high confidentiality requirement and the modified attack vector.
   • DThe base score with a modified scope, because the application is on the internal network.
   Reveal Solution Discussion Select an answer first