200-201 Question 81
Select 3A cybersecurity analyst is assessing a newly discovered vulnerability in a critical system. The team is using the CVSS (Common Vulnerability Scoring System) to prioritize the issue. They are specifically analyzing the temporal metrics to understand the current exploitability and impact of the vulnerability. Which of the following factors are part of the CVSS temporal metrics?
- A
Exploit Code Maturity
- B
Remediation Level
- C
Confidentiality Impact
- D
Report Confidence
- E
Attack Complexity
- F
Environmental Score
Show answer and explanation
Correct answers: A, B, D
Explanation
Temporal metrics in CVSS are used to adjust the base score of a vulnerability to reflect the current state of exploitability and available mitigations. The correct temporal metrics are Exploit Code Maturity, Remediation Level, and Report Confidence. These provide a dynamic assessment of the vulnerability over time, helping organizations prioritize response efforts.
- A. Correct.
Exploit Code Maturity is a temporal metric that evaluates the current level of development or availability of exploit code for the vulnerability.
- B. Correct.
Remediation Level is a temporal metric that assesses the availability and effectiveness of fixes or workarounds for the vulnerability.
- C. Incorrect.
Confidentiality Impact is part of the base metrics, not the temporal metrics, as it measures the impact on confidentiality if the vulnerability is exploited.
- D. Correct.
Report Confidence is a temporal metric that evaluates the level of certainty or credibility of the reported vulnerability.
- E. Incorrect.
Attack Complexity is part of the base metrics, not temporal metrics, as it evaluates the difficulty of exploiting the vulnerability.
- F. Incorrect.
Environmental Score is a separate category of metrics that accounts for specific organizational or environmental factors, not temporal metrics.