CS0-003 Vulnerability Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Attack Vector (AV)

  Why this is correct

  Attack Vector (AV) is a base metric that describes the context by which a vulnerability can be exploited, such as network, adjacent, local, or physical. This metric directly influences the CVSS exploitability subscore and is fundamental because it determines the remote vs. local nature of the attack. A network attack vector is typically the most severe because it allows exploitation from anywhere on the internet without prior access.

• ✓

  Confidentiality (C)

  Why this is correct

  Confidentiality (C) is a base metric that measures the impact on data confidentiality if the vulnerability is exploited, with possible values of none, low, or high. It is a component of the impact subscore in the CVSS Base Score, quantifying the degree of information disclosure to unauthorized parties. This metric is independent of how the attack occurs and instead focuses solely on the outcome regarding data secrecy.

• ✓

  Privileges Required (PR)

  Why this is correct

  Privileges Required (PR) is a base metric that assesses the level of privileges an attacker must possess before successfully exploiting a vulnerability, with categories of none, low, and high. It feeds into the exploitability subscore by reflecting whether the attack requires pre-authentication or post-authentication access, and the level of trust needed to leverage the flaw. This differs from Attack Vector because it centers on authorization requirements, not network reachability.

• ✗

  Remediation Level (RL)

  Why it's wrong here

  Remediation Level (RL) is an environmental metric, not a base metric, because it describes the availability of a fix or mitigation for a specific deployment. Its values—official fix, temporary fix, workaround, or unavailable—help organizations adjust the base score to reflect their actual patch status. Since base metrics are intrinsic to the vulnerability regardless of environment, RL belongs to the environmental metric group.

• ✗

  Exploitability (E)

  Why it's wrong here

  Exploitability (E) is an environmental metric that rates the maturity or likelihood of exploit code being available, ranging from unproven to high. It modifies the base score based on real-world evidence and is not included in the base score calculation itself. The base score's exploitability subscore uses metrics like Attack Vector, Privileges Required, and User Interaction, not the E metric, so E is not a base metric.

Go deeper

Related to this question