CompTIA PenTest+ (PT0-003)Vulnerability Discovery and AnalysisMedium
A vulnerability scan returns a finding with a CVSS v3.1 base score of 7.8. Using the CVSS Qualitative Severity Rating Scale, how should the tester categorize this finding in the report?
- ACritical
- BMedium
- CLow
- DHigh
Show answer & explanationAnswer & explanation
Correct answer: D. High
Per the CVSS v3.1 qualitative scale, scores 7.0–8.9 are rated High, 9.0–10.0 are Critical, 4.0–6.9 are Medium, and 0.1–3.9 are Low. Since 7.8 falls between 7.0 and 8.9, it is classified as High.
Why the other options are wrong
- A. Critical requires a score of 9.0-10.0, above 7.8.
- B. Medium covers 4.0-6.9, below the given score.
- C. Low covers 0.1-3.9, far below the given score.
CVSS Qualitative Severity Scale
A standardized mapping of CVSS v3.x base scores to severity labels used for prioritizing remediation.
- 0.0 = None
- 0.1-3.9 = Low, 4.0-6.9 = Medium
- 7.0-8.9 = High, 9.0-10.0 = Critical
Memory trick: None-Low-Medium-High-Critical: 'Nobody Likes Messy High Crises'