A security analyst was provided with a detailed penetration report, which was performed against the organization's DMZ environment. It was noted on the report that a finding has a CVSS base score of 10.0. Which of the following levels of difficulty would be required to exploit this vulnerability?

Question

Accepted Answer

C. Trivial; little effort is required to exploit this finding. CVSS 10.0 is achieved only when all base metrics are at their worst - network-accessible attack vector, no privileges required, no user interaction, low attack complexity, and complete impact on confidentiality, integrity, and availability. This combination means any remote attacker can exploit the flaw with minimal skill and no setup, making exploitation trivially easy.

Answer

A. Very difficult; perimeter systems are usually behind a firewall. Firewall placement is an environmental or temporal CVSS metric and does not reduce the base score, which measures the inherent difficulty of exploiting the vulnerability independent of network controls.

Answer

B. Somewhat difficult; would require significant processing power to exploit. A CVSS 10.0 requires an Attack Complexity metric of Low by definition, meaning no significant processing power, brute force, or race conditions are needed to trigger the vulnerability.

Answer

D. Impossible; external hosts are hardened to protect against attacks. A CVSS 10.0 represents a fully known and exploitable vulnerability with public or easily replicable exploitation paths - it is the opposite of impossible to exploit.

A security analyst was provided with a detailed penetration report, which was performed against the organization's DMZ environment. It was noted on the report that a finding has a CVSS base score of…

Question

Options

How the community answered

Why each option

Topics

Community Discussion