Which term is used to quantify the severity of vulnerabilities on a standard scale to prioritize remediation?

Which term is used to quantify the severity of vulnerabilities on a standard scale to prioritize remediation?

• A. EF
• B. Secure baseline
• C. Vulnerability feed
• D. CVSS

Answer: (D)

The main thing this question tests is how vulnerabilities are rated on a consistent scale so teams can decide what to fix first. The term used for that standardized, numeric severity scoring is CVSS, the Common Vulnerability Scoring System. CVSS provides a 0 to 10 score (often grouped into none, low, medium, high, and critical) that reflects how severe a vulnerability is and how likely it is to be exploited. It combines factors like how easy it is to exploit, whether remote access is required, and what the potential impact is on confidentiality, integrity, and availability. There are base metrics that describe the inherent characteristics of the vulnerability, and environmental and temporal metrics that help tailor the score to a specific situation or moment in time. This standardization makes it much easier to compare different vulnerabilities and prioritize remediation efforts across systems and teams. The other options don’t offer a universal severity scale. A secure baseline refers to approved configurations and security controls you should maintain, not a scoring method. A vulnerability feed is a stream of vulnerability notices, providing information but not a standardized severity rating. EF isn’t a recognized standard for scoring vulnerability severity in practice.

The main thing this question tests is how vulnerabilities are rated on a consistent scale so teams can decide what to fix first. The term used for that standardized, numeric severity scoring is CVSS, the Common Vulnerability Scoring System. CVSS provides a 0 to 10 score (often grouped into none, low, medium, high, and critical) that reflects how severe a vulnerability is and how likely it is to be exploited. It combines factors like how easy it is to exploit, whether remote access is required, and what the potential impact is on confidentiality, integrity, and availability. There are base metrics that describe the inherent characteristics of the vulnerability, and environmental and temporal metrics that help tailor the score to a specific situation or moment in time. This standardization makes it much easier to compare different vulnerabilities and prioritize remediation efforts across systems and teams.

The other options don’t offer a universal severity scale. A secure baseline refers to approved configurations and security controls you should maintain, not a scoring method. A vulnerability feed is a stream of vulnerability notices, providing information but not a standardized severity rating. EF isn’t a recognized standard for scoring vulnerability severity in practice.