CySA+ CVSS Scoring and Vulnerability Prioritization Quiz

1. In CVSS v3.1, what does a Base Score of 9.0–10.0 indicate?

Low severity

Critical severity

Medium severity

High severity

2. Which CVSS metric directly measures the complexity of the technical attack required to exploit a vulnerability?

Attack Complexity

Privileges Required

Attack Vector

User Interaction

3. Which factor should NOT influence vulnerability prioritization decisions?

Active exploit availability

System criticality and business impact

Alphabetical order of vendor names

Threat actor capabilities and intent

4. True or False: A vulnerability with a high CVSS score always requires immediate patching regardless of compensating controls.

True

False

5. A zero-day vulnerability with no available patch should be assigned which remediation level in CVSS?

Workaround

Unavailable

Temporary Fix

Official Fix

6. Which of the following represents the correct CVSS v3.1 severity rating scale order?

Critical, High, Medium, Low, None

None, Low, Medium, High, Critical

High, Critical, Medium, Low, None

Low, Medium, High, Critical, Severe

7. True or False: CVSS scores remain constant regardless of the organizational environment or business context.

True

False

8. What does Confidentiality impact measure in CVSS?

The ability to modify data

Unauthorized access to sensitive information

System availability degradation

Network latency effects

9. Which prioritization approach combines CVSS scores with asset inventory and business criticality?

Risk-based prioritization

Random patch selection

Alphabetical ordering

Exploit availability ranking

10. In a vulnerability management program, why is threat intelligence important for prioritization?

It replaces CVSS scoring entirely

It identifies vulnerabilities being actively exploited in the wild

It determines CVSS base scores

It eliminates the need for patch testing

11. Which statement about User Interaction in CVSS is correct?

It is always required for network-based exploits

None required (N) means the attacker can exploit without user action

It only applies to social engineering attacks

Required (R) indicates no user interaction is needed

12. What is the primary purpose of the Environmental Score in CVSS?

Measure network bandwidth requirements

Adjust base and temporal scores for organizational context

Determine patch release dates

Calculate vulnerability detection time

Submit

14. Which of the following best describes vulnerability prioritization?

Patching all vulnerabilities simultaneously regardless of risk

Ranking vulnerabilities by exploitability, impact, and business context

Ignoring vulnerabilities with low CVSS scores

Focusing only on the highest CVSS scores without asset consideration

15. Which CVSS metric describes whether an attacker requires special privileges to exploit a vulnerability?

Privileges Required

User Interaction

Attack Complexity

Scope

Submit

18. Which temporal metric indicates whether an exploit is publicly available?

Remediation Level

Report Confidence

Exploit Code Maturity

Attack Complexity

Submit

CySA+ CVSS Scoring and Vulnerability Prioritization Quiz

1. In CVSS v3.1, what does a Base Score of 9.0–10.0 indicate?

2.

What first name or nickname would you like us to use?

2. Which CVSS metric directly measures the complexity of the technical attack required to exploit a vulnerability?

3. Which factor should NOT influence vulnerability prioritization decisions?

4. True or False: A vulnerability with a high CVSS score always requires immediate patching regardless of compensating controls.

5. A zero-day vulnerability with no available patch should be assigned which remediation level in CVSS?

6. Which of the following represents the correct CVSS v3.1 severity rating scale order?

7. True or False: CVSS scores remain constant regardless of the organizational environment or business context.

8. What does Confidentiality impact measure in CVSS?

9. Which prioritization approach combines CVSS scores with asset inventory and business criticality?

10. In a vulnerability management program, why is threat intelligence important for prioritization?

11. Which statement about User Interaction in CVSS is correct?

12. What is the primary purpose of the Environmental Score in CVSS?

13. The Attack Vector metric in CVSS indicates whether exploitation requires physical access, network proximity, or network access. Network attacks score ____ than adjacent network attacks.

14. Which of the following best describes vulnerability prioritization?

15. Which CVSS metric describes whether an attacker requires special privileges to exploit a vulnerability?

16. The Scope metric in CVSS v3.1 changed to measure whether a vulnerability affects resources beyond its ____.

17. A vulnerability affecting a critical production database should typically be prioritized ____ a vulnerability in a development system with an identical CVSS score.

18. Which temporal metric indicates whether an exploit is publicly available?

19. Integrity impact in CVSS v3.1 is rated as High when an attacker can make unauthorized ____ to information or systems.

20. In vulnerability management, the difference between detection and remediation time is called the ____.