CompTIA CySA+ (CS0-003)Vulnerability ManagementHard
A vulnerability with a CVSS v3.1 Base Score of 6.5 exists on a server hosting the organization's core financial ledger. Because a compromise of that ledger's confidentiality would cause severe business harm, the analyst sets the Confidentiality Requirement (CR) to High when calculating the Environmental Score, raising the final adjusted score to 8.1 — higher than the Base Score alone. What does this scenario best illustrate about CVSS scoring?
- ATemporal metrics reduced the exploit code maturity rating
- BCVSS version 4.0 replaced the Base Score calculation entirely
- CThe vulnerability's Scope metric changed from Unchanged to Changed
- DEnvironmental metrics incorporate asset criticality and security requirements to reflect organizational context
Show answer & explanationAnswer & explanation
Correct answer: D. Environmental metrics incorporate asset criticality and security requirements to reflect organizational context
CVSS Environmental metrics, including Confidentiality/Integrity/Availability Requirements (CR/IR/AR), allow organizations to adjust the Base Score up or down to reflect the actual business impact and criticality of the affected asset, producing a more risk-relevant Environmental Score.
Why the other options are wrong
- A. Temporal metrics relate to exploit maturity/remediation level, not asset criticality requirements.
- B. This scenario uses standard CVSS v3.1 Environmental metrics, not a version change.
- C. Scope describes whether impact crosses a security boundary and is a Base metric, unrelated to this adjustment.
CVSS Environmental Metrics
Optional CVSS metrics (Modified Base metrics plus Security Requirements: CR, IR, AR) that let organizations tailor the score to reflect the criticality of the affected asset.
- Can raise or lower the Base Score
- CR/IR/AR = Confidentiality/Integrity/Availability Requirement
- Produces the Environmental Score used for internal risk-based prioritization
Memory trick: Base is generic, Temporal ages it, Environmental makes it personal.