CAS-004 Security Operations Practice Question
A security analyst is reviewing a CVSS score for a vulnerability that affects a critical server. The base score is 7.5, but the analyst needs to adjust for the environment. Which TWO of the following are valid CVSS environmental metrics that can modify the score? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modified Attack Vector (MAV)
CVSS environmental metrics include Confidentiality Requirement, Integrity Requirement, and Availability Requirement (the CIA requirements), as well as Modified Attack Vector, Modified Attack Complexity, etc. The question asks for metrics that modify the score; Modified Attack Vector and Modified Privileges Required are environmental metrics that adjust the base according to the environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Exploit Code Maturity (ECM)
Why it's wrong here
Exploit Code Maturity is a temporal metric, not environmental.
- ✗
Privileges Required (PR)
Why it's wrong here
Privileges Required is a base metric, not environmental.
- ✓
Modified Attack Vector (MAV)
Why this is correct
Modified Attack Vector is an environmental metric that adjusts the base Attack Vector based on the environment.
- ✗
Attack Vector (AV)
Why it's wrong here
Attack Vector is a base metric, not environmental.
- ✓
Modified Privileges Required (MPR)
Why this is correct
Modified Privileges Required is an environmental metric.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.