CVSS Quiz: Can You Calculate The Score?

1. What is the primary purpose of Environmental metrics in CVSS scoring?

To adjust the score based on organization-specific factors

To measure global impact

To determine patch availability

To assess attacker motivation

Submit

4. A vulnerability affecting 'High' Availability means what?

Complete loss of availability of the affected resource

Partial loss of service

Intermittent service disruptions

Minimal impact on service continuity

5. Which of the following is NOT a base metric in CVSS v3.1?

Attack Vector

Privileges Required

Exploit Maturity

Scope

6. A CVSS score of 5.5 would typically be classified as which severity level?

Low

Medium

High

Critical

7. What does 'Attack Complexity' measure in CVSS?

The time required to exploit the vulnerability

Special conditions or preparations needed to exploit the vulnerability

The skill level of the attacker

The number of steps in the exploitation process

8. An exploit with 'Proof of Concept' maturity in temporal metrics indicates what?

The exploit is fully functional and actively used

Proof of concept code exists but may not be functional

No public evidence of exploitation

The vulnerability is theoretical only

9. Which Attack Vector represents the lowest attack complexity?

Local

Adjacent Network

Network

Physical

10. A vulnerability with 'High' Confidentiality impact means what?

All data is encrypted

Total information disclosure with no access restrictions

Partial information disclosure

Information is publicly available

11. What does CVSS stand for?

Common Vulnerability Scoring System

Cyber Vulnerability Security Standard

Critical Vulnerability Severity Scale

Comprehensive Vulnerability Security Service

12. Temporal metrics in CVSS include which of the following factors?

Exploit maturity and remediation level

Only the date the vulnerability was discovered

Only attack complexity

Only affected user count

13. A vulnerability requiring 'Low' privileges means the attacker needs which type of access?

No special access

Unprivileged user-level access

Administrative access

Root or system-level access

14. Which impact metric measures unauthorized access to information?

Integrity

Availability

Confidentiality

Authentication

15. What does 'Scope' refer to in CVSS base metrics?

Geographic area affected by the vulnerability

Whether the vulnerability affects other components beyond the vulnerable one

Number of users impacted

Time duration of the vulnerability

16. An 'Adjacent Network' Attack Vector means the attacker must be on which type of network?

The same physical network segment

The internet

A wireless network only

An authenticated internal network

17. Which metric measures whether an attacker needs user interaction to exploit a vulnerability?

Attack Vector

User Interaction

Privileges Required

Scope

18. What is the range of possible CVSS base scores?

0 to 5

0 to 10

1 to 10

5 to 15

19. A CVSS base score of 9.0 is classified as which severity rating?

High

Critical

Severe

Extreme

20. Which CVSS version is the current standard for CySA+ certification?

CVSS v2.0

CVSS v3.0

CVSS v3.1

CVSS v4.0

CVSS Quiz: Can You Calculate the Score?