CS0-003 Vulnerability Management Practice Question
A security analyst is evaluating a vulnerability with CVSS v3.1 base score: AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N. Which of the following best describes the scope and impact of this vulnerability?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Scope is changed, high impact on confidentiality only
The scope is Changed (S:C), meaning the vulnerable component impacts resources beyond its security scope. The impact is High on confidentiality (C:H), but none on integrity or availability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Scope is unchanged, high impact on confidentiality only
Why it's wrong here
This choice misidentifies the Scope metric: the CVSS vector expresses S:C (Scope Changed), meaning the vulnerability can affect resources beyond the security authority of the vulnerable component. An Unchanged scope would mean impact is confined to that component, but S:C requires evaluating confidentiality relative to the broader impacted system. Thus, while C:H is correct, the scope assertion makes this answer wrong.
- ✗
Scope is changed, high impact on integrity only
Why it's wrong here
This answer incorrectly elevates integrity impact to H; the vector shows I:N, indicating no loss of integrity or data authenticity. The vulnerable component's failure does not allow modification, and only confidentiality is rated high (C:H). Although S:C is accurately stated, claiming I:H conflicts directly with the CVSS vector and cannot be accepted.
- ✗
Scope is unchanged, high impact on confidentiality and integrity
Why it's wrong here
This option contains two errors: it both rejects the correct Scope finding and fabricates an integrity impact. Scope is Changed (S:C), not Unchanged, because the compromise can propagate beyond the component's security boundary. Also, integrity is None (I:N), with no evidence of data alteration, so pairing high confidentiality and integrity with unchanged scope is doubly inconsistent with the vector.
- ✓
Scope is changed, high impact on confidentiality only
Why this is correct
This is correct: the vector specifies S:C (Scope Changed) and C:H (high confidentiality impact), while integrity and availability are None (I:N/A:N). A Changed scope means the vulnerability affects resources outside the vulnerable component's security authority, and the only rated impact is disclosure of sensitive information. These values exactly match the analyst's finding.
Go deeper
Related to this question
Learn chapter
Vulnerability Scanning Techniques
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.