210-255 · Question #78
Which of the following are the three metrics, or "scores," of the Common Vulnerability Scoring System (CVSS)? (Select all that apply.)
The correct answer is B. Base score C. Environmental score D. Temporal score. CVSS defines exactly three metric groups - Base, Temporal, and Environmental - to score vulnerability severity from different perspectives and contexts.
Question
Which of the following are the three metrics, or "scores," of the Common Vulnerability Scoring System (CVSS)? (Select all that apply.)
Options
- ABaseline score
- BBase score
- CEnvironmental score
- DTemporal score
How the community answered
(22 responses)- A5% (1)
- B95% (21)
Why each option
CVSS defines exactly three metric groups - Base, Temporal, and Environmental - to score vulnerability severity from different perspectives and contexts.
'Baseline score' is not a defined CVSS metric group - the correct term is 'Base score,' and this mislabeling is a deliberate distractor used to test precision with CVSS terminology.
The Base score represents the intrinsic characteristics of a vulnerability that remain constant across environments and over time, forming the foundational CVSS score.
The Environmental score adjusts the Base and Temporal scores to reflect the specific security requirements and deployment context of an individual organization.
The Temporal score modifies the Base score to account for factors that change over time, such as exploit code maturity and the availability of official patches or workarounds.
Concept tested: CVSS three metric groups - Base, Temporal, Environmental
Source: https://www.first.org/cvss/v3.1/specification-document
Topics
Community Discussion
No community discussion yet for this question.