Which metric is used to capture the level of access needed to launch a successful attack?

Question

Options

• Aprivileges required
• Buser interaction
• Cattack complexity
• Dattack vector

• A
  90% (19)
• B
  5% (1)
• D
  5% (1)

Explanation

Privileges Required directly measures the level of access or permissions an attacker must already possess before they can successfully carry out an attack - for example, whether no access, basic user access, or administrative access is needed. This metric is a core component of the CVSS (Common Vulnerability Scoring System) and specifically quantifies the access level prerequisite for exploitation.

User Interaction (B) is incorrect because it measures whether a human user must take some action (like clicking a link) for the attack to succeed - it's about human involvement, not access level. Attack Complexity (C) is wrong because it describes the conditions beyond the attacker's control that must exist for success, such as specific configurations or race conditions. Attack Vector (D) is incorrect because it describes the path or method used to reach the vulnerable component (e.g., network, adjacent, local, or physical), not the permission level required.

Memory Tip: Think "Privileges = Permission level needed" - if you need to remember which metric captures how much access an attacker needs, focus on the word "privileges," which is synonymous with access rights or permissions.

No community discussion yet for this question.