CRISC IT Risk Identification Practice Question
When performing asset-based vulnerability identification, a security analyst uses the Common Vulnerabilities and Exposures (CVE) database along with the National Vulnerability Database (NVD). Which of the following BEST describes the relationship between CVE and NVD?
⚠ Common exam trap
Candidates often confuse the roles of CVE and NVD — candidates often assume CVE provides scoring or that NVD assigns the CVE IDs, when in fact CVE is the identifier dictionary and NVD is the enrichment/scoring database.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CVE provides unique identifiers for vulnerabilities, and NVD provides additional analysis including CVSS scores.
CVE (Common Vulnerabilities and Exposures) is a dictionary that assigns a unique identifier (e.g., CVE-2024-12345) to each publicly disclosed vulnerability, providing a common naming standard. NVD (National Vulnerability Database), maintained by NIST, consumes CVE records and enriches them with CVSS base scores, CWE classifications, CPE applicability statements, and references. So CVE provides the identifier and NVD provides the analysis and scoring.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Both databases are identical and maintained by the same organization.
Why it's wrong here
CVE is a naming dictionary of vulnerability identifiers run by MITRE, while NVD enriches those IDs with CVSS scores and CPE data under NIST. They are separate, complementary sources, so identical ownership and content is false. Treating them as one database is tempting because NVD references every CVE, but their purposes differ.
- ✗
CVE is the authoritative source for vulnerability scoring, while NVD assigns identifiers.
Why it's wrong here
NVD, not CVE, calculates CVSS scores and enriches records with CPE applicability data; CVE merely assigns CVE-IDs and publishes minimal descriptions. Reversing these roles misstates the relationship. CVE would be the correct focus when the requirement is a shared identifier namespace for correlating vulnerability references across scanners and vendors.
- ✗
NVD lists only vulnerabilities that are actively exploited, while CVE lists all known vulnerabilities.
Why it's wrong here
NVD enriches CVE records with CVSS scores, CPE applicability and CWE classifications; it does not filter by exploitation status, so the "actively exploited only" claim misstates both databases. The tempting element is the genuine existence of exploitation-focused feeds such as CISA's KEV catalogue, which would be the right source when prioritising remediation by observed exploitation.
- ✓
CVE provides unique identifiers for vulnerabilities, and NVD provides additional analysis including CVSS scores.
Why this is correct
CVE assigns each publicly disclosed vulnerability a unique identifier (CVE-YYYY-NNNN). NVD enriches those CVE records with analysis, including CVSS severity scores, CWE classification and affected product data, so the two are complementary rather than duplicates.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.