An organization is conducting a vulnerability triage and risk analysis. The security team wants to prioritize vulnerabilities effectively using industry scoring systems. Which method should the team…

Question

Options

• AUse the CVSS base score and correlate with the number of network vulnerabilities found.
• BAssign a CVSS environmental score and analyze historical exploitation trend data.
• CDetermine the CVSS temporal score and focus on immediate patch deployment decisions.
• DCalculate the CVSS base score and integrate asset criticality and threat intelligence insights.

• A
  5% (2)
• B
  23% (9)
• C
  10% (4)
• D
  63% (25)

Explanation

D is correct because effective vulnerability triage requires more than a raw severity score - you need to know how critical the affected asset is to your organization and whether attackers are actively exploiting it. The CVSS base score provides a standardized severity foundation, but integrating asset criticality (e.g., is this a public-facing payment server or an isolated dev box?) and threat intelligence (e.g., is there active exploitation in the wild?) transforms a generic score into a risk-ranked action list.

Why the distractors fail:

• A - Correlating base score with "number of network vulnerabilities" is a volume metric, not a risk metric; quantity doesn't indicate business impact or exploitability.
• B - The environmental score already accounts for asset-specific factors, but relying on "historical exploitation trends" alone ignores current threat intelligence; this is also incomplete and partially redundant with D.
• C - The temporal score reflects exploit code maturity and vendor patch availability, which is useful for patch timing but too narrow to drive a thorough risk assessment.

Memory tip: Think of CVSS as a calculator with three lenses - Base (how bad universally), Temporal (how bad right now), Environmental (how bad for you). The best triage combines the universal baseline (Base score) with your unique context (asset criticality + live threat intel) - that's option D.

No community discussion yet for this question.