CS0-003 Vulnerability Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  The attacker can exploit the vulnerability over a network from a remote system

  Why this is correct

  In the Common Vulnerability Scoring System (CVSS), an Attack Vector of Network (AV:N) means the vulnerability is exploitable from any remote system that can reach the target over a network connection. This includes sending specially crafted IP packets, protocol-specific requests, or application-layer payloads without requiring any prior authentication or local access. The attacker does not need to be co-located on the target's local subnet, merely capable of network connectivity.

• ✗

  The attacker must be on the same physical network segment

  Why it's wrong here

  The CVSS Attack Vector of Adjacent (AV:A) describes a requirement where the attacker must reside on the same physical or logical network segment as the target, such as a switched Ethernet broadcast domain, a Wi-Fi network, or a Bluetooth personal area network. In contrast, Network (AV:N) explicitly allows remote exploitation across routing domains, so the threat does not depend on local segment proximity. Therefore, this answer incorrectly narrows the attack scope to a segment-level condition.

• ✗

  The attacker requires local access to the target system

  Why it's wrong here

  The CVSS Attack Vector of Local (AV:L) denotes that the attacker must have acquired a local foothold on the target system, typically meaning they need to be able to execute code or commands on the device itself, often after gaining a low-privilege account or convincing the user to run a file. This is fundamentally different from Network (AV:N), which requires no local presence because the attack is delivered entirely over a network protocol. Accordingly, local access is not equivalent to remote network-based exploitation.

• ✗

  The attacker must be physically present at the device

  Why it's wrong here

  The CVSS Attack Vector of Physical (AV:P) requires the attacker to have direct physical interaction with the hardware, such as opening the device chassis, attaching a debugging cable, booting from a malicious USB drive, or accessing a vendor maintenance port. This is the most restrictive possibility and implies the attacker cannot operate from anywhere except hands-on proximity. Because Network (AV:N) lacks any such physical presence requirement, this answer mistakenly equates remote exploitability with hardware-level access.

Go deeper

Related to this question