CS0-003 Vulnerability Management Practice Question
During a vulnerability scan, a security analyst identifies a critical vulnerability with a CVSS v3.1 base score of 9.8. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which component of this vector indicates that the vulnerability can be exploited without any user interaction?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
UI:N
The UI (User Interaction) metric in the CVSS vector is set to N (None), meaning no user action is required for exploitation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AC:L
Why it's wrong here
The AC:L metric represents Attack Complexity: Low, which means that specialized conditions do not need to exist for the attack to succeed. While this indicates the vulnerability is easy to exploit, it measures the technical hurdles or environmental factors required for execution rather than whether a human user must actively participate in the exploit chain.
- ✗
AV:N
Why it's wrong here
The AV:N metric designates Attack Vector: Network, which specifies that the vulnerability can be exploited remotely over a network, such as the Internet or a local intranet. This metric defines the physical or logical reachability required by the attacker to launch the exploit, which is entirely distinct from whether a victim must interact with the malicious payload.
- ✗
PR:N
Why it's wrong here
The PR:N metric denotes Privileges Required: None, indicating that an unauthenticated attacker can exploit the vulnerability without possessing any prior access rights or credentials on the target system. Although this significantly increases the severity of the vulnerability, it does not describe whether a local user must perform an action to trigger the exploit.
- ✓
UI:N
Why this is correct
The UI:N metric stands for User Interaction: None, which explicitly confirms that the vulnerability can be exploited without any active participation or assistance from a local user. This means the attack can be executed entirely out-of-band and automatically, making it highly dangerous compared to vulnerabilities requiring social engineering or user actions like clicking a link.
Go deeper
Related to this question
Learn chapter
Zero-Day Vulnerability Response
Key term
CVSS
The Common Vulnerability Scoring System (CVSS) is a standardized framework used to rate the severity of security vulnerabilities on a scale from 0 to 10.
Key term
Exploitation
Exploitation is the act of using a vulnerability or weakness in a system, network, or application to gain unauthorized access, cause damage, or extract data.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.