200-201 Question 70
Select 3A cybersecurity analyst is reviewing a vulnerability report that includes a CVSS score of 9.8. The report identifies the vulnerability as having a high impact on confidentiality, integrity, and availability. Additionally, it states that the vulnerability can be exploited remotely without authentication. Based on the CVSS scoring system, which terms correctly describe key characteristics of this vulnerability?
- A
Attack Vector: Network
- B
Attack Complexity: High
- C
Privileges Required: None
- D
Confidentiality Impact: High
- E
User Interaction: Required
Show answer and explanation
Correct answers: A, C, D
Explanation
This question tests your understanding of CVSS terms by applying them to a scenario. CVSS metrics such as Attack Vector, Privileges Required, and Confidentiality Impact are key to accurately describing a vulnerability's characteristics. In this case, the vulnerability's exploitability (network-based, no required privileges) and its impact (high confidentiality impact) align with the correct CVSS terms.
- A. Correct.
The 'Attack Vector: Network' term indicates that the vulnerability can be exploited remotely, as mentioned in the scenario. This matches the CVSS definition for this metric.
- B. Incorrect.
The 'Attack Complexity: High' term is incorrect because the scenario does not indicate that exploitation requires special conditions or significant effort, which would instead suggest 'Attack Complexity: Low.'
- C. Correct.
The 'Privileges Required: None' term is correct because the scenario explicitly states that the vulnerability can be exploited without authentication, aligning with this CVSS metric description.
- D. Correct.
The 'Confidentiality Impact: High' term is correct because the scenario mentions a high impact on confidentiality, integrity, and availability, which matches the CVSS definition of high impact.
- E. Incorrect.
The 'User Interaction: Required' term is incorrect because the scenario does not mention any action from a user being necessary for the exploitation, which would instead indicate 'User Interaction: None.'