Vulnerability classification (CVSS) in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding CVSS Base Score Components

Which of the following is NOT a component of the CVSS Base Score?

A Privileges Required

B User Interaction

C Exploit Code Maturity

D Attack Vector

💡 Hint

Think about the core factors that describe the vulnerability itself, not the environment or temporal factors.

The CVSS Base Score includes Attack Vector, User Interaction, Privileges Required, Confidentiality, Integrity, and Availability impacts. Exploit Code Maturity is part of the Temporal Score, not the Base Score.

📋 Factual

intermediate

CVSS Attack Vector Impact

What does an Attack Vector value of Network indicate in CVSS?

A The vulnerability can only be exploited locally on the device.

B The vulnerability can be exploited remotely over a network.

C The vulnerability requires physical access to exploit.

D The vulnerability requires user interaction to exploit.

💡 Hint

Consider how far the attacker needs to be to exploit the vulnerability.

An Attack Vector of Network means the attacker can exploit the vulnerability remotely over a network without physical or local access.

🔍 Analysis

advanced

Calculating CVSS Base Score Impact

Given a vulnerability with the following CVSS Base metrics:
Attack Vector: Network
Privileges Required: None
User Interaction: None
Confidentiality Impact: High
Integrity Impact: Low
Availability Impact: None

Which of the following best describes the overall impact on the system?

A High impact on availability, low on confidentiality, no integrity impact

B Low impact on confidentiality, high on integrity, no availability impact

C No impact on confidentiality, integrity, or availability

D High impact on confidentiality, low on integrity, no availability impact

💡 Hint

Review each impact metric carefully and match them to the description.

The given metrics specify a high confidentiality impact, low integrity impact, and no availability impact, matching option D.

❓ Reasoning

advanced

Temporal Metrics Influence on CVSS Score

How does the Exploit Code Maturity temporal metric affect the CVSS score over time?

A It increases the score as exploit code becomes more available and reliable.

B It decreases the score as exploit code becomes more available and reliable.

C It has no effect on the CVSS score.

D It only affects the environmental score, not the temporal score.

💡 Hint

Think about how the availability of exploit code changes the risk level.

Exploit Code Maturity increases the CVSS score when exploit code is widely available and reliable, indicating higher risk.

❓ Comparison

expert

Comparing CVSS Environmental Metrics

Which environmental metric in CVSS adjusts the score based on how important the affected system's Confidentiality is to an organization?

A Security Requirements - Confidentiality

B Modified Confidentiality Impact

C Confidentiality Impact

D Attack Complexity

💡 Hint

Consider which metric lets an organization express how critical confidentiality is for their environment.

Security Requirements - Confidentiality allows organizations to adjust the score based on how important confidentiality is to them, affecting the environmental score.