200-201 Question 83
Single answerA cybersecurity analyst is assessing the environmental metrics of a vulnerability using the CVSS (Common Vulnerability Scoring System). The vulnerability exists in a web application running on an internal server but does not affect any other interconnected systems. The server is hosted on a private network with no direct internet access, and only authenticated users can interact with it. Which environmental metric should the analyst prioritize when evaluating the potential risk of this vulnerability?
- A
Confidentiality Requirement (CR)
- B
Exploitability (E)
- C
Availability Requirement (AR)
- D
Attack Vector (AV)
Show answer and explanation
Correct answer: A
Explanation
The Confidentiality Requirement (CR) is part of the environmental metrics in the CVSS framework and is used to assess how important confidentiality is to the impacted system. In this scenario, the web application is on a private network and requires authentication, suggesting that confidentiality could be a priority. The other options either do not pertain to environmental metrics or are less relevant in this specific context.
- A. Correct.
Confidentiality Requirement (CR) is an environmental metric in the CVSS framework. It measures how critical confidentiality is to the affected system, which is crucial in this scenario as sensitive data may be involved in the internal application.
- B. Incorrect.
Exploitability (E) is a temporal metric, not an environmental metric. It measures the likelihood of exploitation but does not assess the specific impact on the environment.
- C. Incorrect.
Availability Requirement (AR) is an environmental metric, but it is less critical in this scenario unless the application’s availability has a strong impact on the organization’s operations.
- D. Incorrect.
Attack Vector (AV) is a base metric, not an environmental metric. It measures how the vulnerability can be exploited rather than its environmental impact.