200-201 Security Concepts Practice Question
A security analyst is reviewing a vulnerability scan report and sees a finding labeled 'CVE-2021-44228' with a CVSS score of 10.0. The analyst needs to prioritize remediation. Which factor does the CVSS score primarily represent?
⚠ Common exam trap
The trap here is assuming CVSS predicts real-world exploitation; it is a severity score, not a threat intelligence metric.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The severity of the vulnerability based on its technical impact and exploitability
CVSS is a standardized framework for rating the severity of security vulnerabilities. The base score, such as 10.0, reflects intrinsic characteristics like exploitability and impact. It does not predict exploitation likelihood, business-specific impact, or remediation time. Analysts use CVSS alongside other factors to prioritize remediation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The likelihood that the vulnerability will be exploited in the wild within the next 30 days
Why it's wrong here
CVSS does not predict the likelihood of exploitation within a specific timeframe. It is a static score based on intrinsic characteristics. Threat intelligence feeds or EPSS (Exploit Prediction Scoring System) provide likelihood estimates. The scenario asks what CVSS represents, and it is not a temporal prediction of exploitation within 30 days.
- ✗
The amount of time required to patch the vulnerability
Why it's wrong here
CVSS does not measure remediation time or effort. It is focused on the technical severity of the vulnerability. Remediation time depends on factors like patch availability, change management, and system criticality. The scenario asks what the CVSS score represents, and it is not related to patching duration.
- ✓
The severity of the vulnerability based on its technical impact and exploitability
Why this is correct
CVSS (Common Vulnerability Scoring System) provides a numerical score reflecting the severity of a vulnerability based on metrics such as attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. A score of 10.0 indicates maximum severity. The scenario asks what the CVSS score primarily represents, and it is the severity based on technical impact and exploitability.
- ✗
The business impact of the vulnerability specific to the organization's assets
Why it's wrong here
CVSS provides a generic severity score, not a business-specific impact. Environmental metrics can adjust the score based on the organization's environment, but the base score does not represent business impact. The scenario asks what the CVSS score primarily represents, and it is not tailored to the organization's specific assets.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.