nerdexam
CompTIA

CS0-003 · Question #201

A security analyst reviews the latest vulnerability scans and observes there are vulnerabilities with similar CVSSv3 scores but different base score metrics. Which of the following attack vectors…

The correct answer is C. CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. When prioritizing vulnerabilities with similar overall CVSS scores, the attack vector (AV) is a critical factor, with Network (N) being the most severe as it can be exploited remotely over the network.

Submitted by certguy· Mar 6, 2026Vulnerability Management

Question

A security analyst reviews the latest vulnerability scans and observes there are vulnerabilities with similar CVSSv3 scores but different base score metrics. Which of the following attack vectors should the analyst remediate first?

Options

  • ACVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • BCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • DCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

How the community answered

(26 responses)
  • A
    19% (5)
  • B
    4% (1)
  • C
    65% (17)
  • D
    12% (3)

Why each option

When prioritizing vulnerabilities with similar overall CVSS scores, the attack vector (AV) is a critical factor, with Network (N) being the most severe as it can be exploited remotely over the network.

ACVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSSv3 'AV:P' (Physical) indicates the attacker must have physical access to the vulnerable system, which is a significantly more difficult and less common attack vector than remote exploitation.

BCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSSv3 'AV:A' (Adjacent Network) indicates the attacker must be on the same local network segment or broadcast domain, which is less accessible than a vulnerability exploitable from any point on the internet.

CCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCorrect

The CVSSv3 'AV:N' (Network) attack vector indicates that the vulnerability can be exploited remotely over a network, without requiring physical access or local interaction. This represents the broadest attack surface and highest potential for exploitation, making it the highest priority for remediation compared to vulnerabilities requiring adjacent, local, or physical access.

DCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSSv3 'AV:L' (Local) indicates the attacker must have local access (e.g., a shell account) to the vulnerable system, making it less severe than a remote network exploit.

Concept tested: CVSSv3 attack vector prioritization

Source: https://www.first.org/cvss/v3.1/specification-document

Topics

#CVSSv3#vulnerability prioritization#attack vector#remediation

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice