CAS-004 Security Operations Practice Question
A security analyst is reviewing CVSS scores for vulnerability prioritization. Which TWO of the following are component metric groups in CVSS v3?
⚠ Common exam trap
CAS-005 often tests the distinction between CVSS metric groups and their sub-metrics, tricking candidates into selecting Impact or Exploitability as standalone groups when they are actually Base sub-components.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Temporal
In CVSS v3, the score is built from three metric groups: Base, Temporal, and Environmental. Option B (Temporal) is correct because it is one of the three metric groups, capturing characteristics that change over time such as Exploit Code Maturity, Remediation Level, and Report Confidence. Option D (Environmental) is also correct because it is a metric group that lets analysts customize the score based on their own environment, including Confidentiality/Integrity/Availability Requirements and modified base metrics. The unmarked options do not belong because Impact, Exploitability, and Attack Vector are not metric groups; Impact and Exploitability are Base metric sub-scores, and Attack Vector is a single Base metric, not a group.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Impact
Why it's wrong here
Impact is a sub-score of Base, not a separate group.
- ✓
Temporal
Why this is correct
Temporal metrics capture characteristics that change over time, such as exploit code maturity, remediation level and report confidence, modifying the Base score without altering the intrinsic vulnerability. CVSS v3 defines exactly three metric groups: Base, Temporal and Environmental.
- ✗
Exploitability
Why it's wrong here
Exploitability is a sub-score of Base, not a separate metric group.
- ✓
Environmental
Why this is correct
Environmental metrics adjust the Base score to reflect a specific organisation's deployed configuration, including confidentiality, integrity and availability requirements plus modified base metrics. Alongside Base and Temporal, Environmental forms one of CVSS v3's three metric groups.
- ✗
Attack Vector
Why it's wrong here
Attack Vector is a metric within Base, not a group.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.