CVSS Metric Types: Base, Temporal, and Environmental
During a recent vulnerability assessment of a major corporation's IT systems, the security team identified several potential risks. They want to use a vulnerability scoring system to quantify and prioritize these vulnerabilities. They decide to use the Common Vulnerability Scoring System (CVSS). Given the characteristics of the identified vulnerabilities, which of the following statements is the most accurate regarding the metric types used by CVSS to measure these vulnerabilities?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests knowledge of CVSS metric definitions, with the common trap being confusion between Base (inherent), Temporal (changing over time), and Environmental (context-specific) metrics.
This question tests the understanding of CVSS metric categories, specifically distinguishing between Base, Temporal, and Environmental metrics. It establishes that the Base metric represents the inherent qualities of a vulnerability.
Most learners incorrectly chose C, confusing the definition of the Temporal metric with that of the Environmental metric, which deals with specific environments.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The Base metric represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. It includes factors like Attack Vector, Scope, and Impact, which define the fundamental nature of the flaw itself. Therefore, statement B is the most accurate description among the choices.Why the Other Options Are Wrong
Option A is incorrect because the Temporal metric reflects features that change over time, such as exploit code availability or remediation level, not inherent qualities. Option C is incorrect because measuring vulnerabilities based on a specific environment describes the Environmental metric, not the Temporal metric. Option D is incorrect because features changing during the lifetime of a vulnerability refer to the Temporal metric, whereas the Environmental metric focuses on the specific deployment context.Community Comment Notes
The community overwhelmingly voted for B, citing the official EC-Council handbook which states "Base Metric: It represents the inherent qualities of a vulnerability." Some users like 'pechuga' and 'cloudgangster' argued for C, likely misinterpreting the term "Temporal" as relating to a specific point in time or environment, but this contradicts standard CVSS documentation where Temporal refers to changes over the vulnerability's lifecycle.Exam Strategy
When studying CVSS, create a mental map of the three metric groups: Base (Inherent), Temporal (Time-based changes), and Environmental (Context-specific). Memorize the key descriptors for each to avoid swapping definitions during the exam.
Frequently Asked Questions
What is the difference between Temporal and Environmental metrics?
Temporal metrics change over time (e.g., exploit availability), while Environmental metrics are specific to an organization's environment.
Why is option C wrong about Temporal metrics?
Temporal metrics track changes over the vulnerability's life, not measurements based on a specific implementation environment.