Which CVSS Version 3.1 metric indicates how close an attacker needs to be to the vulnerable component?

Question

Options

• APrivileges Required
• BUser Interaction
• CAttack Vector
• DScope
• EAvailability
• FAttack Complexity

• B
  3% (1)
• C
  3% (1)
• D
  88% (30)
• F
  6% (2)

Explanation

Important note: The marked correct answer (D - Scope) appears to be incorrect. The actual correct answer is C. Attack Vector.

Attack Vector is the CVSS 3.1 metric that directly measures attacker proximity to the vulnerable component. It has four values in ascending closeness: Network (fully remote), Adjacent (same network segment), Local (requires local system access), and Physical (requires physical contact with the device).

Why the distractors are wrong:

• A. Privileges Required - measures what level of permissions an attacker needs beforehand, not their physical/network proximity
• B. User Interaction - measures whether a victim must take an action (e.g., click a link) for exploitation to succeed
• D. Scope - measures whether a successful exploit can impact components beyond the vulnerable one (Unchanged vs. Changed), not attacker proximity
• E. Availability - is an Impact metric measuring disruption to service access, not an Exploitability metric at all
• F. Attack Complexity - measures conditions outside the attacker's control that must exist for success (e.g., race conditions), not proximity

Memory tip: Think AV = Access Vector = how you reach the target. The closer the value is to "Physical," the closer the attacker must be. If your exam question has "Scope" as the right answer here, flag it - that is a question error.

No community discussion yet for this question.