Which of the following is best to use when determining the severity of a vulnerability?

Question

Options

• ACVE
• BOSINT
• CSOAR
• DCVSS

• A
  3% (2)
• B
  2% (1)
• C
  5% (3)
• D
  90% (57)

Explanation

CVSS (Common Vulnerability Scoring System) is the industry-standard framework specifically designed to rate the severity of vulnerabilities on a numeric scale (0–10), categorized as None, Low, Medium, High, or Critical - making it the right tool for determining how serious a vulnerability is.

Why the distractors are wrong:

• CVE (A) is a dictionary/identifier system that names and catalogs vulnerabilities with a unique ID (e.g., CVE-2021-44228), but it does not score or rank their severity.
• OSINT (B) refers to gathering intelligence from publicly available sources - it's an investigative technique, not a scoring system.
• SOAR (C) stands for Security Orchestration, Automation, and Response - it's a platform for automating incident response workflows, unrelated to scoring vulnerabilities.

Memory tip: Think of the SS in CVSS as "Severity Score" - it's the only option with "scoring" built right into its name, which is exactly what you need when quantifying how bad a vulnerability is.

No community discussion yet for this question.