CISSP Security Assessment and Testing Practice Question
A vulnerability scanner reports a vulnerability with a CVSS score of 9.8. What does this score indicate?
⚠ Common exam trap
Candidates often confuse the CVSS v3.1 severity rating scale with the older v2 scale, where scores of 7.0–10.0 were all labeled 'High', but in v3.1, 9.0–10.0 is explicitly 'Critical'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Critical severity
A CVSS score of 9.8 falls within the range of 9.0–10.0, which is classified as 'Critical' severity according to the CVSS v3.1 specification. This score typically indicates a vulnerability that can be exploited remotely without authentication and with low attack complexity, often leading to complete compromise of confidentiality, integrity, and availability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
High severity
Why it's wrong here
A CVSS score of 9.8 significantly exceeds the defined range for High severity vulnerabilities, which spans from 7.0 to 8.9. This classification is reserved for issues that, while serious, do not reach the absolute highest level of impact or exploitability. Therefore, a 9.8 score indicates a more severe threat than what is categorized as merely "High" and requires a higher priority for remediation.
- ✗
Medium severity
Why it's wrong here
A CVSS score of 9.8 is far above the threshold for Medium severity, which encompasses scores between 4.0 and 6.9. Vulnerabilities in this category typically have moderate impact or require specific conditions for exploitation, making them less immediately critical than those with higher scores. Assigning a 9.8 to this category would drastically misrepresent its potential danger and lead to inadequate prioritization.
- ✗
Low severity
Why it's wrong here
A CVSS score of 9.8 is drastically higher than the range designated for Low severity vulnerabilities, which typically fall between 0.1 and 3.9. Low severity issues generally have minimal impact on confidentiality, integrity, or availability, or are very difficult to exploit. Classifying a 9.8 score as low severity would be a severe misjudgment of its potential risk and urgency, potentially leading to catastrophic consequences.
- ✓
Critical severity
Why this is correct
A CVSS score of 9.8 unequivocally falls within the Critical severity range, defined as scores from 9.0 to 10.0. This classification signifies vulnerabilities that are extremely severe, often easily exploitable, and can lead to complete loss of confidentiality, integrity, or availability without requiring user interaction or elevated privileges. Such a high score demands immediate attention and remediation due to the profound potential for widespread damage and business disruption.
Go deeper
Related to this question
Learn chapter
Security Assessment and Testing
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.