CS0-003 Vulnerability Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Scope (S)

  Why it's wrong here

  Scope (S) is a CVSS base metric that captures whether a vulnerability can cause impact beyond the security authority of the vulnerable component, such as affecting a different security domain. It is not an impact metric itself because it does not measure the direct consequence on data or system; instead, it modifies how the confidentiality, integrity, and availability impacts are scored when the scope changes. The CVSS specification categorizes S as a separate metric, so it cannot be classified as an impact metric.

• ✗

  Attack Vector (AV)

  Why it's wrong here

  Attack Vector (AV) is an exploitability metric in the CVSS base score that describes the level of access an attacker needs to exploit the vulnerability, ranging from Network (AV:N) to Physical (AV:P). It is not an impact metric because it focuses on the conditions required to launch the attack, not the outcome or damage caused after exploitation, such as data loss or system compromise.

• ✓

  Confidentiality (C)

  Why this is correct

  Confidentiality (C) is one of the three core impact metrics in the CVSS base score, assessing the degree of unauthorized information disclosure that results from an exploit. It measures the impact on data privacy, where a rating of High means complete loss of confidentiality, such as exposing sensitive user credentials or protected records. This metric directly reflects the impact on the CIA triad's confidentiality component, making it a valid impact metric.

• ✓

  Availability (A)

  Why this is correct

  Availability (A) is a CVSS impact metric that quantifies the disruption of access to a system, service, or data, for example through a denial-of-service condition that prevents legitimate users from accessing resources. A rating of High indicates a complete loss of availability, such as a system being shutdown or becoming unresponsive. Because it directly measures the operational impact on the victim, it is considered an impact metric rather than an exploitability metric.

• ✓

  Integrity (I)

  Why this is correct

  Integrity (I) is a CVSS impact metric that measures the extent to which data or system information is unauthorizedly modified or corrupted, such as tampering with configuration files or injecting malicious content. A High integrity impact means the attacker can completely overwrite or alter the target data, destroying its trustworthiness. This qualifies as an impact metric because it evaluates the consequence on data correctness, which is distinct from confidentiality (disclosure) and availability (disruption).

Go deeper

Related to this question