Cyber Security Quiz: Cve Cvss Scoring
10 questions · exam conditions
0:00
Cve Cvss ScoringQuestion 1 of 10

A scanner assigns CVE-2026-12345 a CVSS v3.1 Base score of 9.89.8 on two servers. Server 1 is an isolated test system containing synthetic data. Server 2 is an internet-facing production system that processes customer transactions.

Which interpretation of the scanner results is most accurate?

The CVE identifier and Base score must change for Server 1 because its operational risk is lower.
The Base score can remain the same, while environmental context produces different remediation priorities.
Server 2 must receive a different CVE identifier because exploitation would cause greater business loss.
The Base score already accounts for exposure and data value, so both servers require equal priority.
← Back to quizzes

Cyber Security Quiz

Cyber Security Quiz: Cve Cvss Scoring

Practice Cve Cvss Scoring in Cyber Security with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Cve Cvss Scoring, giving you a quick way to practice the rules, question types, and explanations that matter most for Cyber Security.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

A scanner assigns CVE-2026-12345 a CVSS v3.1 Base score of 9.89.8 on two servers. Server 1 is an isolated test system containing synthetic data. Server 2 is an internet-facing production system that processes customer transactions.

Which interpretation of the scanner results is most accurate?

  1. The CVE identifier and Base score must change for Server 1 because its operational risk is lower.
  2. The Base score can remain the same, while environmental context produces different remediation priorities. (correct answer)
  3. Server 2 must receive a different CVE identifier because exploitation would cause greater business loss.
  4. The Base score already accounts for exposure and data value, so both servers require equal priority.
Explanation: Whenever you see a question involving CVSS scores across different environments, remind yourself of a core principle: the Base score measures intrinsic vulnerability severity, not business risk. It stays constant regardless of where the vulnerability exists. Context-specific risk is handled separately through the CVSS Environmental Score, which lets organizations adjust for factors like exposure, data sensitivity, and compensating controls. This is exactly why B is correct. CVE-2026-12345 carries a Base score of 9.89.8 on both servers because the underlying vulnerability — its attack vector, complexity, privileges required, and impact — hasn't changed. What has changed is the operational context. Server 2 is internet-facing and handles real customer data, so its environmental score would be significantly higher, driving a more urgent remediation priority. Server 1, isolated with synthetic data, would score lower environmentally, appropriately deprioritizing it. Same Base score, different urgency — that's the system working correctly. A is wrong because CVE identifiers and Base scores are globally standardized. They don't change based on where a system sits in your network. Changing them would break the entire purpose of a universal vulnerability catalog. C is wrong for the same foundational reason — CVE identifiers track the vulnerability, not the business impact of exploitation. Greater financial exposure doesn't earn a new CVE number. D is wrong because it confuses what the Base score does measure with what it doesn't. The Base score explicitly excludes environmental and temporal factors; it does not account for network exposure or data sensitivity. Study tip: On security exams, always distinguish between CVSS Base (universal, static) and Environmental/Temporal scores (local, adjustable) — questions love to blur that line.

Question 2

A database vulnerability has a vendor-assigned CVSS v3.1 Base score reflecting high confidentiality impact and low availability impact. One organization stores only public data in the database, but the database must remain continuously available for a safety-monitoring service.

Which action best applies CVSS environmental concepts to this organization?

  1. Replace the vendor's Base vector by changing confidentiality to low and availability to high.
  2. Retain the Base assessment and use environmental requirements to emphasize availability over confidentiality. (correct answer)
  3. Request a new CVE whose identifier reflects the organization's safety-monitoring use case.
  4. Reduce Attack Complexity because operational dependence makes successful exploitation more consequential.
Explanation: When you see a question about CVSS scoring and organizational context, think about the layered nature of the framework: Base scores are vendor-assigned and universal, but Environmental metrics exist precisely so your organization can adjust severity to reflect your specific assets and operational needs — without touching the Base score itself. CVSS v3.1 Environmental metrics include Modified Base Metrics and, critically, Security Requirements — specifically Confidentiality Requirement (CR), Integrity Requirement (IR), and Availability Requirement (AR). In this scenario, the organization stores only public data, so confidentiality loss is nearly irrelevant to them. However, the database supports a continuous safety-monitoring service, making availability paramount. The correct approach is B: retain the vendor's Base score intact and use Environmental Requirements to set CR to Low and AR to High. This produces an adjusted Environmental score that accurately reflects the organization's true risk posture — high availability priority, low confidentiality priority. A is wrong because you never replace the Base vector. The Base score is vendor-assigned and standardized so all organizations share a common reference point. Modifying it defeats interoperability and violates the CVSS architecture. C is a fundamental misunderstanding — CVE identifiers track vulnerabilities, not organizational use cases. You cannot request a new CVE simply because your context differs. D confuses consequence with Attack Complexity. Operational dependence affects impact to your organization, which is addressed through Environmental metrics — not by altering the Attack Complexity metric, which describes how difficult exploitation is technically. Your study tip: remember the CVSS hierarchy — Base (universal) → Temporal (exploit maturity) → Environmental (your org). Adjusting risk context always belongs in Environmental, never by rewriting Base.

Question 3

A security team must choose which of two vulnerabilities to remediate first. Vulnerability X has a CVSS Base score of 9.69.6, affects a disabled internal service, and has no observed exploitation. Vulnerability Y has a Base score of 7.57.5, affects an internet-facing service, and is being actively exploited against the organization.

Which prioritization decision is best supported by a correct interpretation of CVSS?

  1. Always remediate X first, because a higher Base score is the complete and authoritative measure of organizational risk.
  2. Treat both vulnerabilities equally, because observed exploitation makes CVSS Base score differences irrelevant to prioritization.
  3. Always remediate Y first, because active exploitation automatically raises its CVSS Base score to the Critical rating.
  4. Remediate Y first, because active exploitation and internet exposure are contextual factors that can outweigh a lower Base score. (correct answer)
Explanation: When you see a CVSS prioritization question, remember the key distinction: the CVSS Base score measures inherent vulnerability severity, not organizational risk. It deliberately excludes environmental and threat context. Effective prioritization requires layering additional factors — exposure, exploitability, and business impact — on top of the Base score. This is exactly why D is correct. Vulnerability Y's active exploitation means attackers are already causing harm to the organization right now, and its internet-facing exposure dramatically increases attack surface. CVSS explicitly supports supplementing Base scores with Temporal metrics (like exploit code maturity) and Environmental metrics (like attack surface). A 7.57.5 vulnerability being actively weaponized against you is a more urgent operational threat than a 9.69.6 vulnerability on a disabled service that no one is targeting. A represents the most common trap on CVSS questions: treating the Base score as the sole, complete measure of risk. CVSS documentation explicitly warns against this misuse. A high Base score on a disabled service presents near-zero actual risk. B goes too far in the opposite direction. Active exploitation is highly relevant, but it doesn't make Base score differences irrelevant — both factors inform prioritization together, not in isolation. C contains a factual error. Active exploitation does not automatically raise the CVSS Base score. Exploitation status may influence the Temporal score, which is a separate, optional scoring layer — it never retroactively changes the Base score. Study tip: On exam questions involving CVSS, watch for answers that treat Base score as absolute or that confuse Base, Temporal, and Environmental score components — these are the most frequently tested misconceptions.

Question 4

A software vendor publishes a CVE with a CVSS v3.1 score of 8.18.1. A vulnerability database lists the same CVE with a score of 9.19.1 and a different vector. Both assessments claim to describe the same affected software version.

What should an analyst conclude first?

  1. The higher score supersedes the lower score and becomes the CVE's single authoritative severity.
  2. The lower score is authoritative because the affected software vendor always controls CVSS scoring.
  3. Different scoring sources may make different metric judgments, so the vectors and assumptions should be compared. (correct answer)
  4. The score difference proves that one source assigned the CVE identifier to the wrong vulnerability.
Explanation: When you see a question about CVSS scoring discrepancies, think about who assigns scores and why they might differ. CVSS v3.1 is a framework, not a single authoritative database — multiple parties (NVD, vendors, researchers) can score the same CVE independently, and each makes its own judgment calls about metrics like Attack Complexity, Privileges Required, or Scope. Those different assumptions produce different vectors, which produce different scores. That's exactly what's happening here: a vendor scores the CVE at 8.18.1 while a vulnerability database scores it 9.19.1. Before acting on either number, you need to compare the actual vector strings to understand why they differ — maybe the vendor assumes a mitigating control in their environment, or the database assumed network-level scope. Answer C captures this correctly: the analyst's first step is to examine the vectors and underlying assumptions, not simply defer to one source. Answer A is wrong because no single source automatically "wins." CVSS has no rule that the highest score is authoritative; that assumption could lead to unnecessary panic or wasted resources. Answer B is wrong because vendors do not have exclusive authority over CVSS scoring — the NVD and third-party researchers routinely publish independent scores that carry their own legitimacy. Answer D is wrong because a score difference alone does not indicate a misidentified vulnerability; CVE identifiers are controlled by CNAs and don't shift based on scoring disagreements. The vectors can describe the same flaw differently without an identity error. Your study tip: whenever you see two CVSS scores for the same CVE, your instinct should always be "compare the vectors first" — the numbers mean nothing without the metric context behind them.

Question 5

A CVSS v3.1 Base-score calculation produces an unrounded value of 8.948.94. The analyst must apply the CVSS v3.1 roundup convention and then assign the standard qualitative rating.

What final result should the analyst report?

  1. 8.98.9, High — ordinary rounding to one decimal place places the score in the High band.
  2. 8.98.9, Critical — the raw value is close enough to 9.0 to qualify for the Critical band.
  3. 9.09.0, High — the qualitative band is locked in before the roundup step is applied.
  4. 9.09.0, Critical — the CVSS roundup function rounds up to one decimal place, reaching the Critical threshold. (correct answer)
Explanation: Whenever you see a CVSS v3.1 scoring question, keep two distinct rules in mind: the Roundup function and the qualitative severity bands. These are applied sequentially, and confusing their order — or confusing Roundup with ordinary rounding — is exactly what this question tests. CVSS v3.1 defines a specific Roundup function: it always rounds up to the nearest one decimal place (ceiling toward the next tenth), never down. Applying that to 8.948.94: the first decimal is already 8.98.9, but since there is a non-zero remainder beyond one decimal place (the 0.040.04), Roundup pushes the score up to 9.09.0. Once you have 9.09.0, you apply the qualitative bands — scores from 9.09.0 to 10.010.0 are rated Critical. The final report is therefore 9.09.0, Critical, confirming D. A is wrong because it applies ordinary rounding (8.94→8.98.94 \rightarrow 8.9) rather than the CVSS Roundup function, which always rounds up, never down. B is wrong on two counts: it uses the incorrect rounded value of 8.98.9 and misapplies the band — 8.98.9 falls in High (7.07.0–8.98.9), not Critical. "Close enough" is never a valid CVSS concept. C correctly computes 9.09.0 via Roundup but then assigns the wrong band. The qualitative label is applied after Roundup, so 9.09.0 is unambiguously Critical, not High. Study tip: Memorize that CVSS Roundup is a strict ceiling function — if any digit exists past the first decimal, the score goes up. Then remember the Critical threshold starts exactly at 9.09.0, making boundary values like this a favorite exam trap.

Question 6

A malicious website exploits a defect in a browser's sandboxed rendering process. The exploit escapes the sandbox and modifies operating-system files controlled by a separate security authority.

Under CVSS v3.1, how should the Scope metric most likely be assessed?

  1. Unchanged, because the browser remains the initial vulnerable component and the impact authority is irrelevant.
  2. Unchanged, because exploitation begins through ordinary network-delivered content, which keeps scope constant.
  3. Changed, because impact crosses from the browser sandbox into an operating-system authority. (correct answer)
  4. Changed, because any vulnerability that modifies files necessarily changes scope regardless of authority boundaries.
Explanation: When evaluating CVSS v3.1 Scope, the central question is always: does the exploit's impact extend beyond the security authority of the vulnerable component? A "security authority" is the entity—an OS, a hypervisor, a sandbox—that defines and enforces access controls over resources. Scope is Changed when a vulnerability allows impact to reach a different authority than the one containing the flaw. Here, the vulnerable component is the browser's sandboxed rendering process. That sandbox operates under its own restricted authority. When the exploit escapes and modifies OS files, impact crosses into the operating system's authority—a completely separate security domain. That boundary crossing is exactly what CVSS defines as Changed scope, making C correct. A is wrong because it misreads the metric. Scope isn't about whether the browser remains involved; it's about whether a different authority is affected. The OS authority absolutely is relevant—it's the reason Scope changes. B confuses Scope with Attack Vector. Network-delivered content determines how an attacker reaches the vulnerability (Attack Vector: Network), not whether impact stays within one authority. These are independent metrics, and conflating them is a common trap. D sounds logical but overreaches. File modification alone doesn't determine Scope—what matters is whose authority governs those files. If the browser modified its own sandboxed files, Scope would remain Unchanged even though files were modified. Study tip: When you see "sandbox escape" or "privilege boundary crossing" in a scenario, immediately ask yourself: did impact move to a different security authority? If yes, Scope is Changed—that phrasing is almost always your signal.

Question 7

An analyst receives the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N for a web application vulnerability.

Which description is most consistent with this vector?

  1. A local attacker with privileges can exploit it without user action and cause limited availability loss.
  2. A network attacker with no privileges can exploit it without user action and affect another authority.
  3. A network attacker with no privileges needs user action and causes limited confidentiality and integrity impact. (correct answer)
  4. An adjacent attacker with low privileges needs user action and causes high confidentiality and integrity impact.
Explanation: When you see a CVSS 3.1 vector, treat it as a structured code where each metric tells a specific story. Breaking down the vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N piece by piece confirms that C is correct: AV:N means the attack vector is Network (remote attacker), PR:N means no privileges are required, UI:R means user interaction is required, S:U means the scope is Unchanged (no authority boundary crossed), C:L and I:L mean limited confidentiality and integrity impact, and A:N means no availability impact. Every element of option C maps directly to these values. Option A fails on multiple metrics. It claims a local attacker (AV:N says Network), with privileges (PR:N says none required), without user action (UI:R says interaction is needed), and an availability loss (A:N says none). That's four mismatches. Option B is close but critically wrong on two points: it claims exploitation happens without user action (the vector says UI:R — user interaction is required), and it claims the impact crosses an authority boundary (S:U means scope is Unchanged, not S:C which would indicate scope change). Option D misidentifies the attack vector as Adjacent (AV:A), attributes low privileges (PR:L), and claims high confidentiality and integrity impact — none of which match the vector. Your study tip: memorize the CVSS metric abbreviations and their values as a lookup table. On exam day, decode the vector field-by-field like a key-value map — don't read it holistically or you'll miss subtle traps like UI:R vs. UI:N or S:U vs. S:C.

Question 8

An attacker can store a malicious script in a customer-support ticket without authentication. The script executes only when a support agent later opens that ticket in a browser.

Which pair of CVSS v3.1 exploitability metrics best represents this scenario?

  1. AV:N and UI:R, because the payload is submitted remotely but requires a victim's later action. (correct answer)
  2. AV:L and UI:R, because script execution ultimately occurs inside the agent's local browser.
  3. AV:N and UI:N, because the attacker does not personally interact with the support agent.
  4. AV:A and UI:R, because the attacker and victim must access the same application environment.
Explanation: When analyzing CVSS v3.1 exploitability metrics, focus on where the attacker delivers the payload and whether a human must act for exploitation to occur — not where the code physically runs or who initiates the conversation. In this scenario, the attacker submits a malicious script over the internet (no physical or network-adjacent access needed), making Attack Vector Network (AV:N) correct. Crucially, the script only executes when a support agent opens the ticket — meaning a separate human action is required after the attacker's submission. That's the definition of User Interaction Required (UI:R). Answer A captures both realities precisely. Answer B misidentifies the attack vector as Local (AV:L) by confusing where execution happens (inside a browser) with how the attacker delivers the payload. AV:L requires the attacker to have local system access — that's not the case here. Answer C gets AV:N right but wrongly assigns UI:N. UI:N means exploitation happens without any victim action; here, the agent must open the ticket, which is exactly the human interaction CVSS UI:R is designed to capture. The attacker not directly "talking to" the agent is irrelevant — what matters is whether a victim's action is required. Answer D incorrectly applies AV:A (Adjacent Network), which requires the attacker and victim to share a local network or broadcast domain. Using a web application over the internet doesn't qualify. As a study tip, remember: Attack Vector describes delivery, not execution location. If the attacker reaches the target over the public internet, it's AV:N — regardless of what the browser or OS does afterward.

Question 9

At disclosure, a vulnerability has only a theoretical proof of concept. Two weeks later, reliable exploit code becomes publicly available. The vulnerable software and the technical impacts have not changed.

Under CVSS v3.1, which scoring response is most appropriate?

  1. Increase the Base score, because public exploit code changes the vulnerability's inherent attack complexity.
  2. Keep the Base score unchanged and update the Temporal score using the Exploit Code Maturity metric. (correct answer)
  3. Issue a new CVE identifier, because reliable exploitation represents a materially different vulnerability state.
  4. Lower the Environmental score, because public exploit availability removes organization-specific uncertainty.
Explanation: When you see a CVSS question involving changes over time — like exploit code becoming available — your first instinct should be to ask: "Has the vulnerability itself changed, or has the threat landscape around it changed?" CVSS v3.1 is built around exactly this distinction through its three score groups: Base, Temporal, and Environmental. The Base score captures the intrinsic characteristics of a vulnerability — attack vector, complexity, privileges required, impact — things that don't change regardless of time or context. When reliable exploit code surfaces, the underlying flaw in the software hasn't changed at all. What has changed is how easily adversaries can weaponize it. That's precisely what the Temporal score's Exploit Code Maturity (E) metric is designed to track. It starts at "Proof-of-Concept" at disclosure and can be updated to "Functional" or "High" as exploitation matures — without touching the Base score. So B is correct: keep the Base score stable and revise the Temporal score accordingly. A is wrong because Attack Complexity is a Base metric reflecting the technical conditions needed to exploit a vulnerability, not whether exploit code is freely downloadable. Public availability of an exploit doesn't retroactively change how complex the underlying attack is. C is wrong because CVE identifiers represent discrete vulnerabilities, not exploitation maturity states. A new CVE would imply a new vulnerability was discovered — that hasn't happened here. D is wrong because Environmental scores adjust for your organization's specific context (like mitigating controls or asset criticality), not for public exploit availability, which is a temporal concern. Study tip: Memorize the purpose of each CVSS score tier — Base = inherent, Temporal = time-sensitive threat context, Environmental = organizational context. Exam questions will try to blur these boundaries.

Question 10

An internet-facing API accepts a crafted request from an unauthenticated user. Successful exploitation creates an administrator account, which the attacker can then use to alter system settings.

What is the most appropriate Privileges Required assessment for the vulnerability itself under CVSS v3.1?

  1. None, because no authorization is needed before sending the request that triggers exploitation. (correct answer)
  2. Low, because the attacker obtains an authenticated account during the exploitation sequence.
  3. High, because the resulting account can modify security-sensitive administrator settings.
  4. Low, because network access is an implicit form of limited system privilege.
Explanation: When evaluating CVSS v3.1 metrics, you must assess each metric based on the conditions that exist before and during exploitation — not the consequences that result from it. Privileges Required (PR) specifically asks: what level of access does the attacker need to possess before sending the triggering request? In this scenario, the attacker sends a crafted request with zero prior credentials or authorization. That single unauthenticated request is sufficient to trigger the vulnerability. This makes A the correct answer — PR is None, because no privileges are required to launch the attack. Choice B is a classic trap. The attacker gains an administrator account as an outcome of exploitation, but CVSS measures what the attacker needs going in, not what they walk away with. Confusing post-exploitation results with pre-exploitation requirements is one of the most common scoring mistakes. Choice C compounds this error further — the fact that the resulting account has high-privilege capabilities describes the impact of the vulnerability (specifically Confidentiality, Integrity, and Availability scope), not the Privileges Required metric. High PR would only apply if the attacker themselves needed to already hold admin credentials before triggering the flaw. Choice D introduces a fictional CVSS concept — network reachability is captured by the Attack Vector metric (Network), not Privileges Required. There is no notion of "implicit network privilege" in the CVSS v3.1 specification. A useful rule of thumb: for every CVSS metric, ask yourself "what did the attacker need before the exploit ran?" If the answer is nothing, PR is None — regardless of how powerful the resulting access becomes.