CS0-003 Vulnerability Management Practice Question
A security analyst is using a vulnerability scanner to identify missing patches on Windows servers. The scanner uses plugins that reference Common Vulnerabilities and Exposures (CVE) identifiers. Which THREE of the following are components of a CVSS v3.1 base score vector?
⚠ Common exam trap
CS0-004 often tests whether candidates can distinguish Base metrics from Temporal metrics, tricking them into selecting Exploitability (E) or Remediation Level (RL) because those sound like core vulnerability characteristics.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attack Vector (AV)
The CVSS v3.1 base score vector is composed of Exploitability metrics (Attack Vector, Attack Complexity, Privileges Required, User Interaction) and Impact metrics (Confidentiality, Integrity, Availability). Option A, Attack Vector (AV), is correct because AV is an Exploitability metric in the base group, with values Network (N), Adjacent (A), Local (L), and Physical (P). Option B, Confidentiality (C), is correct because C is one of the three Impact metrics (C/I/A) in the base score, reflecting the degree of confidentiality loss. Option C, Privileges Required (PR), is correct because PR is an Exploitability metric in the base group, with values None (N), Low (L), and High (H). Option D, Remediation Level (RL), is incorrect because RL belongs to the Temporal score group, not the base score. Option E, Exploitability (E), is incorrect because E is a Temporal metric (with values Unproven, Proof-of-Concept, Functional, High, Not Defined), not a base metric.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Attack Vector (AV)
Why this is correct
Attack Vector (AV) is a base metric that describes the context by which a vulnerability can be exploited, such as network, adjacent, local, or physical. This metric directly influences the CVSS exploitability subscore and is fundamental because it determines the remote vs. local nature of the attack. A network attack vector is typically the most severe because it allows exploitation from anywhere on the internet without prior access.
- ✓
Confidentiality (C)
Why this is correct
Confidentiality (C) is a base metric that measures the impact on data confidentiality if the vulnerability is exploited, with possible values of none, low, or high. It is a component of the impact subscore in the CVSS Base Score, quantifying the degree of information disclosure to unauthorized parties. This metric is independent of how the attack occurs and instead focuses solely on the outcome regarding data secrecy.
- ✓
Privileges Required (PR)
Why this is correct
Privileges Required (PR) is a base metric that assesses the level of privileges an attacker must possess before successfully exploiting a vulnerability, with categories of none, low, and high. It feeds into the exploitability subscore by reflecting whether the attack requires pre-authentication or post-authentication access, and the level of trust needed to leverage the flaw. This differs from Attack Vector because it centers on authorization requirements, not network reachability.
- ✗
Remediation Level (RL)
Why it's wrong here
Remediation Level (RL) is an environmental metric, not a base metric, because it describes the availability of a fix or mitigation for a specific deployment. Its values—official fix, temporary fix, workaround, or unavailable—help organizations adjust the base score to reflect their actual patch status. Since base metrics are intrinsic to the vulnerability regardless of environment, RL belongs to the environmental metric group.
- ✗
Exploitability (E)
Why it's wrong here
Exploitability (E) is an environmental metric that rates the maturity or likelihood of exploit code being available, ranging from unproven to high. It modifies the base score based on real-world evidence and is not included in the base score calculation itself. The base score's exploitability subscore uses metrics like Attack Vector, Privileges Required, and User Interaction, not the E metric, so E is not a base metric.
Go deeper
Related to this question
Learn chapter
OWASP Top 10 for Security Analysts
Key term
Attack vector
An attack vector is the specific path or method a cyber attacker uses to gain unauthorized access to a computer system or network.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
This CS0-004 question is part of Courseiva's 701-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.