Vulnerability Discovery and Analysis

CVSS Scoring and Finding Classification

CVSS gives every vulnerability a structured, repeatable severity score, but the exam expects you to know which metric group captures which kind of factor, and how to classify what a scanner actually found.

Exam tip. Base never changes, temporal changes for everyone over time, environmental changes for one specific organization.

1. Reviewing a CVSS vector string for a finding at Aldergate Financial Group, a tester sees the metric segment "PR:N". What does this component represent?

• A. The scope of impact across security authorities
• B. The complexity of executing the attack
• C. The privileges required by an attacker before exploitationcorrect
• D. The confidentiality impact of a successful exploit

PR, Privileges Required, indicates the level of privileges an attacker must have before exploiting the vulnerability, with N meaning none are required. Scope, attack complexity, and confidentiality impact are represented by other distinct metrics in the vector string, not PR.

2. A vulnerability scan of Redshaw Financial's environment produces a CVSS score. One of the base metrics describes whether the vulnerability can be exploited from across a network versus only by someone with physical access to the machine. Which CVSS base metric captures this distinction?

• A. Attack Complexity
• B. Attack Vectorcorrect
• C. Privileges Required
• D. User Interaction

Attack Vector describes the context from which a vulnerability can be exploited, ranging from network to physical access. Attack Complexity describes conditions beyond the attacker's control needed for exploitation, Privileges Required describes what access level the attacker needs beforehand, and User Interaction describes whether a victim must take an action.