CVSS Metric Types: Base, Temporal, and Environmental

312-50v12 By islever Editorial Last updated

Vulnerability Analysis

Short answer

B The Base metric represents the inherent qualities of a vulnerability.

Question

During a recent vulnerability assessment of a major corporation's IT systems, the security team identified several potential risks. They want to use a vulnerability scoring system to quantify and prioritize these vulnerabilities. They decide to use the Common Vulnerability Scoring System (CVSS). Given the characteristics of the identified vulnerabilities, which of the following statements is the most accurate regarding the metric types used by CVSS to measure these vulnerabilities?
  1. Temporal metric represents the inherent qualities of a vulnerability.
  2. Base metric represents the inherent qualities of a vulnerability. Correct Answer
  3. Temporal metric involves measuring vulnerabilities based on a specific environment or implementation.
  4. Environmental metric involves the features that change during the lifetime of the vulnerability.

Key Takeaways

The question tests knowledge of CVSS metric definitions, with the common trap being confusion between Base (inherent), Temporal (changing over time), and Environmental (context-specific) metrics.

This question tests the understanding of CVSS metric categories, specifically distinguishing between Base, Temporal, and Environmental metrics. It establishes that the Base metric represents the inherent qualities of a vulnerability.

Common mistake: Most learners incorrectly chose C, confusing the definition of the Temporal metric with that of the Environmental metric, which deals with specific environments.

Expert Analysis

Why the Answer Is Correct

The Base metric represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. It includes factors like Attack Vector, Scope, and Impact, which define the fundamental nature of the flaw itself. Therefore, statement B is the most accurate description among the choices.

Why the Other Options Are Wrong

Option A is incorrect because the Temporal metric reflects features that change over time, such as exploit code availability or remediation level, not inherent qualities. Option C is incorrect because measuring vulnerabilities based on a specific environment describes the Environmental metric, not the Temporal metric. Option D is incorrect because features changing during the lifetime of a vulnerability refer to the Temporal metric, whereas the Environmental metric focuses on the specific deployment context.

Community Comment Notes

The community overwhelmingly voted for B, citing the official EC-Council handbook which states "Base Metric: It represents the inherent qualities of a vulnerability." Some users like 'pechuga' and 'cloudgangster' argued for C, likely misinterpreting the term "Temporal" as relating to a specific point in time or environment, but this contradicts standard CVSS documentation where Temporal refers to changes over the vulnerability's lifecycle.

Exam Strategy

When studying CVSS, create a mental map of the three metric groups: Base (Inherent), Temporal (Time-based changes), and Environmental (Context-specific). Memorize the key descriptors for each to avoid swapping definitions during the exam.

Frequently Asked Questions

What is the difference between Temporal and Environmental metrics?

Temporal metrics change over time (e.g., exploit availability), while Environmental metrics are specific to an organization's environment.

Why is option C wrong about Temporal metrics?

Temporal metrics track changes over the vulnerability's life, not measurements based on a specific implementation environment.

More 312-50v12 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. qwerty100 👍 6 Answered B
    B. Base metric represents the inherent qualities of a vulnerability. (Module 05 Page 528) Base Metric: It represents the inherent qualities of a vulnerability. Temporal Metric: It represents the features that continue to change during the lifetime of the vulnerability. Environmental Metric: It represents vulnerabilities that are based on a particular environment or implementation.
  2. insaniunt 👍 3 Answered B
    B - Base metric represents the inherent qualities of a vulnerability. The Base metric measures the fundamental properties of a vulnerability, such as attack vector, impact, complexity, need for user interaction, scope, and required privileges
  3. qtygbapjpesdayazko 👍 1 Answered B
    B. Base metric represents the inherent qualities of a vulnerability. Most Voted
  4. LordXander 👍 1 Answered B
    I would go with B because it in the handbook
  5. pechuga 👍 1
    I think its C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide