The Common Vulnerability Scoring System (CVSS) provides a standardized way to evaluate the severity of security vulnerabilities. It includes:
Base Metrics: Inherent characteristics of a vulnerability (e.g., attack vector, complexity).
Temporal Metrics: Factors that change over time (e.g., exploit availability).
Environmental Metrics: Customization based on an organization's environment.
Correct answers:
Helping to prioritize remediation based on threat context (Option B):
CVSS scores help organizations prioritize vulnerabilities based on real-world impact.
The Environmental metric allows customization based on business risk.
Reference: CompTIA PenTest+ PT0-003 Official Study Guide - "Risk Prioritization in Reporting" Providing information on attack complexity and vector (Option D):
CVSS Base scores define attack complexity (e.g., low vs. high) and attack vector (e.g., network vs. physical).
This helps security teams understand how a vulnerability can be exploited.
Reference: CompTIA PenTest+ PT0-003 Official Study Guide - "CVSS Metrics in Vulnerability Assessment" Incorrect options:
Option A (Providing remediation details): CVSS does not include remediation steps; it only scores severity.
Option C (Proof-of-concept exploit links): CVSS scores are not based on specific exploits.
Option E (Compliance information): CVSS focuses on technical risk, not regulatory compliance.
Option F (Adding risk levels to assets): CVSS evaluates individual vulnerabilities, not asset risk classification.