CySA+ CVSS Scoring and Prioritization

1. Which temporal metric reflects the availability of public exploit code?

Exploit Code Maturity

Remediation Level

Report Confidence

Attack Complexity

2. In CVSS v3.1, a vulnerability rated 'Critical' has a base score of at least ____.

7.0

8.0

9.0

10.0

3. Which vulnerability management practice helps reduce response time to critical issues?

Performing annual vulnerability assessments

Establishing prioritization criteria based on risk

Scanning only production systems

Waiting for vendor patches

4. What does Attack Complexity measure in the CVSS base metrics?

Number of systems affected

Conditions required for successful exploitation

Time needed to patch

Cost of remediation

5. In a vulnerability management program, which step typically follows CVSS scoring?

Vulnerability scanning

Remediation planning and prioritization

Patch release

Vulnerability discovery

6. What does the Integrity impact metric measure in CVSS?

Unauthorized data modification

Loss of data availability

System performance degradation

Network connectivity issues

7. Which of the following is a limitation of using CVSS scores alone for prioritization?

They ignore technical attack requirements

They don't account for organizational context

They only apply to critical vulnerabilities

They require constant recalculation

8. In vulnerability management, what does Risk = Likelihood × Impact represent?

CVSS base score calculation

A fundamental risk assessment formula

Temporal metric weighting

Environmental score adjustment

9. Which CVSS metric indicates whether the attack requires user interaction to succeed?

Attack Vector

User Interaction

Privileges Required

Attack Complexity

10. What is the primary purpose of vulnerability prioritization in an organization?

Eliminate all vulnerabilities immediately

Focus remediation efforts on highest-risk issues

Document every discovered vulnerability

Comply with regulatory scanning requirements

11. What does CVSS stand for in vulnerability management?

Common Vulnerability Scoring System

Cybersecurity Vulnerability Security Standard

Critical Vulnerability Severity Scale

Comprehensive Vulnerability Search System

12. In CVSS, what does a Scope value of 'Changed' mean?

The vulnerability affects only the vulnerable component

Exploitation impacts resources beyond the vulnerable component

The vulnerability changes over time

Multiple systems must be updated

13. Which vulnerability characteristic indicates the ease with which an attacker can exploit it?

Exploitability

Impact severity

Temporal factors

Environmental scope

14. What do environmental metrics in CVSS allow security teams to do?

Reduce base scores only

Adjust scores based on organizational context

Eliminate vulnerability risk

Bypass vulnerability scanning

15. In vulnerability prioritization, which factor is NOT part of the base CVSS score?

Attack Vector

Business criticality

Privileges Required

Scope

16. Which CVSS severity rating range includes scores from 7.0 to 8.9?

High

Medium

Critical

Low

17. What does the Confidentiality impact metric measure in CVSS?

Loss of data availability

Unauthorized information disclosure

System downtime risk

Data modification capability

18. Which attack vector indicates an attacker must have physical access to the vulnerable component?

Network

Adjacent Network

Local

Physical

19. In CVSS v3.1, what is the highest possible base score?

8.0

9.0

10.0

12.0

20. Which CVSS metric represents whether an attacker can exploit a vulnerability without special privileges?

Attack Vector

Privileges Required

User Interaction

Scope

CySA+ CVSS Scoring and Vulnerability Prioritization Quiz

1. Which temporal metric reflects the availability of public exploit code?

2.

What first name or nickname would you like us to use?

2. In CVSS v3.1, a vulnerability rated 'Critical' has a base score of at least ____.

3. Which vulnerability management practice helps reduce response time to critical issues?

4. What does Attack Complexity measure in the CVSS base metrics?

5. In a vulnerability management program, which step typically follows CVSS scoring?

6. What does the Integrity impact metric measure in CVSS?

7. Which of the following is a limitation of using CVSS scores alone for prioritization?

8. In vulnerability management, what does Risk = Likelihood × Impact represent?

9. Which CVSS metric indicates whether the attack requires user interaction to succeed?

10. What is the primary purpose of vulnerability prioritization in an organization?

11. What does CVSS stand for in vulnerability management?

12. In CVSS, what does a Scope value of 'Changed' mean?

13. Which vulnerability characteristic indicates the ease with which an attacker can exploit it?

14. What do environmental metrics in CVSS allow security teams to do?

15. In vulnerability prioritization, which factor is NOT part of the base CVSS score?

16. Which CVSS severity rating range includes scores from 7.0 to 8.9?

17. What does the Confidentiality impact metric measure in CVSS?

18. Which attack vector indicates an attacker must have physical access to the vulnerable component?

19. In CVSS v3.1, what is the highest possible base score?

20. Which CVSS metric represents whether an attacker can exploit a vulnerability without special privileges?