CISSP Security Assessment and Testing Practice Question
Which vulnerability scoring system provides a standardized severity rating for vulnerabilities based on exploitability and impact metrics?
⚠ Common exam trap
ISC2 often tests the distinction between a vulnerability database (NVD), an identifier system (CVE), a weakness taxonomy (CWE), and a scoring system (CVSS), so the trap is confusing the repository or identifier with the actual scoring methodology.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CVSS
The Common Vulnerability Scoring System (CVSS) provides a standardized, quantitative framework for rating the severity of security vulnerabilities. It calculates a score from 0.0 to 10.0 based on exploitability metrics (e.g., attack vector, complexity, privileges required) and impact metrics (e.g., confidentiality, integrity, availability), enabling organizations to prioritize remediation efforts consistently.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
NVD
Why it's wrong here
The National Vulnerability Database (NVD) is a U.S. government repository of standards-based vulnerability management data, including CVEs and their associated CVSS scores. While NVD aggregates and presents these scores, it is not the system that defines or calculates the standardized severity score itself. Instead, it serves as a comprehensive database for public consumption, integrating various vulnerability-related information from multiple sources.
- ✗
CVE
Why it's wrong here
Common Vulnerabilities and Exposures (CVE) provides a unique, standardized identifier for publicly known cybersecurity vulnerabilities. Its primary function is to enable consistent referencing and data sharing across different security tools and databases, facilitating communication about specific vulnerabilities. However, CVE IDs themselves do not contain any information regarding the severity, impact, or exploitability of a vulnerability; they are purely for identification.
- ✓
CVSS
Why this is correct
The Common Vulnerability Scoring System (CVSS) is an open industry standard designed to provide a qualitative and quantitative method for assessing the severity of software vulnerabilities. It generates a numerical score, ranging from 0.0 to 10.0, based on various metrics like attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. This standardized scoring allows organizations to objectively prioritize vulnerability remediation efforts based on a consistent, globally recognized framework.
- ✗
CWE
Why it's wrong here
Common Weakness Enumeration (CWE) is a community-developed list of common software weaknesses and vulnerability types, serving as a dictionary of potential flaws in software design, architecture, or implementation. Its purpose is to help developers and security professionals identify, mitigate, and prevent these weaknesses in code. Unlike CVSS, CWE focuses on categorizing the types of weaknesses rather than assigning a severity score to specific instances of discovered vulnerabilities.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.