CS0-003 Vulnerability Management Practice Question
A security analyst reviews a Nessus scan result for a web server. The plugin output indicates a critical vulnerability with CVSS v3.1 base score 9.8. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which of the following best describes the attack complexity?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Low
In the CVSS vector, AC:L means Attack Complexity is Low, indicating no special conditions are required for exploitation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Low
Why this is correct
The CVSS vector string 'AC:L' explicitly denotes a Low Attack Complexity. This means that a successful attack does not require specialized conditions beyond the attacker's control, nor does it demand extensive preparation or specific timing. Attackers can typically exploit such vulnerabilities with readily available techniques and resources, making the attack relatively straightforward and increasing its likelihood.
- ✗
Critical
Why it's wrong here
Critical is a final severity rating derived from the CVSS Base Score, not a specific metric value for Attack Complexity. The Attack Complexity metric within CVSS v3.x is designed to describe the conditions beyond the attacker's control that must exist for a successful attack, and its permissible values are limited to 'Low' or 'High', not 'Critical'. Therefore, 'Critical' is an inappropriate selection for this metric.
- ✗
Medium
Why it's wrong here
The CVSS v3.x framework does not include 'Medium' as a valid value for the Attack Complexity metric. This metric is strictly binary, indicating whether specialized conditions or extensive preparation are required for an exploit, with only 'Low' (L) or 'High' (H) as its defined options. Therefore, selecting 'Medium' for Attack Complexity is inconsistent with the CVSS standard and incorrect.
- ✗
High
Why it's wrong here
The provided CVSS vector explicitly states 'AC:L', which signifies a Low Attack Complexity, directly contradicting the option of 'High'. High Attack Complexity would be represented by 'AC:H' in the vector string, indicating that specialized conditions or significant attacker effort are required for a successful exploit. Therefore, 'High' is an incorrect interpretation of the given vulnerability details.
Go deeper
Related to this question
Learn chapter
Vulnerability Scanning Techniques
Key term
CVSS
The Common Vulnerability Scoring System (CVSS) is a standardized framework used to rate the severity of security vulnerabilities on a scale from 0 to 10.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.