CS0-003 Vulnerability Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Privileges Required (PR)

  Why this is correct

  The Privileges Required (PR) metric measures the level of access privileges an attacker must possess prior to successfully exploiting the vulnerability. It is scored as None, Low, or High, directly reflecting whether the exploit requires administrative control, standard user access, or no authentication at all.

• ✗

  Attack Vector (AV)

  Why it's wrong here

  The Attack Vector (AV) metric represents the physical or logical context through which an attacker can access the vulnerable system. It categorizes the exploit path based on proximity, ranging from Network (remote) to Physical, rather than assessing the authorization level or credentials required by the threat actor.

• ✗

  Attack Complexity (AC)

  Why it's wrong here

  Attack Complexity (AC) evaluates the environmental conditions or specialized configurations outside of the attacker's direct control that must exist for the exploit to succeed. This metric focuses on factors like race conditions or specific system states, rather than the privilege level or credentials of the executing security principal.

• ✗

  User Interaction (UI)

  Why it's wrong here

  The User Interaction (UI) metric determines whether a human user, other than the attacker, must actively participate or execute an action for the vulnerability to be successfully exploited. It is rated as None or Required, distinguishing automated attacks from those requiring social engineering, which is independent of the attacker's privilege level.

Go deeper

Related to this question