Identifying Least Impactful Vulnerability via CVSS3.1 Metrics

CS0-003 By islever Editorial Last updated

Given a scenario, analyze data to prioritize vulnerabilities

Short answer

D The vulnerability with C:L, I:L, and A:L represents the least impactful risk because all confidentiality, integrity, and availability impacts are minimal.

Question

A vulnerability analyst received a list of system vulnerabilities and needs to evaluate the relevant impact of the exploits on the business. Given the constraints of the current sprint, only three can be remediated. Which of the following represents the least impactful risk, given the CVSS3.1 base scores?
  1. AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L - Base Score 6.0
  2. AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L - Base Score 7.2
  3. AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H - Base Score 6.4
  4. AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L - Base Score 6.5 Correct Answer

Key Takeaways

The exam often tricks candidates into selecting the lowest base score; however, 'impact' specifically refers to the C/I/A sub-scores, requiring analysis of the string values.

This question tests the ability to analyze CVSS3.1 metrics to determine the least impactful risk by focusing on Confidentiality, Integrity, and Availability (CIA) scores rather than just the base score.

Common mistake: Candidates frequently choose Option A because it has the lowest numerical base score (6.0), ignoring that the question asks for 'least impactful' which is defined by the CIA metrics.

Expert Analysis

Why the Answer Is Correct

Option D is the correct answer because it has Low (L) values for all three impact metrics: Confidentiality (C:L), Integrity (I:L), and Availability (A:L). In CVSS v3.1, the 'Impact' sub-score is derived exclusively from these three components. Since all are 'Low', this vulnerability poses the smallest potential damage to the business if exploited, regardless of how easily it might be exploited.

Why the Other Options Are Wrong

Option A has the lowest base score (6.0) but its impact metrics are High/High/Low, meaning it causes significant data loss or integrity issues. Option B has a higher base score (7.2) and Critical Scope with High impacts. Option C has High impacts across the board. The question explicitly asks for 'least impactful,' not 'easiest to exploit' or 'lowest risk score.'

Community Comment Notes

The community consensus strongly supports D. As one user noted, "you only need to focus on the las three /C:L/I:L/A:L because is asking for the least impactful." Another commenter clarified, "It may be more likely to be exploited than A, but it wouldn't have as much impact," highlighting the distinction between exploitability and impact.

Official Reference

https://www.first.org/cvss/specification-document

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question specifies 'impact,' immediately isolate the C, I, and A metrics in the CVSS string. Do not get distracted by the Base Score number or the Exploitability metrics (Attack Vector, Complexity, etc.) unless the question asks for overall risk prioritization.

Frequently Asked Questions

Does a lower base score always mean less impact?

No. Base score combines exploitability and impact. A vuln can have a low base score (hard to exploit) but high impact if successfully used.

Why is Option A incorrect despite having the lowest score?

Option A has High Confidentiality and Integrity impacts. The question asks for 'least impactful,' not 'lowest risk score.'

More CS0-003 FAQ →

Discussion 38 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 38

  1. BanesTech 👍 18 Answered D
    The answer is D. A. Total Impact Score = C + I + A = 0.56 + 0.56 + 0.22 = 1.34 B. Total Impact Score = C + I + A = 0.56 + 0.56 + 0.22 = 1.34 C. Total Impact Score = C + I + A = 0.56 + 0.56 + 0.56 = 1.68 D. Total Impact Score = C + I + A = 0.22 + 0.22 + 0.22 = 0.66 Therefore, vulnerability D represents the least impactful risk, given the CVSS3.1 base scores, as it has the lowest total impact score.
  2. c83335b 👍 8 Answered D
    you only need to focus on the las three /C:L/I:L/A:L because is asking for the least impactful so basically is D.
  3. lilegg 👍 4
    This is a legit explanation, the numbers don't lie.
  4. Kmelaun 👍 4
    After further investigation, D would be correct.
  5. Narobi 👍 4
    Scored around 820. Went with D
Show 25 more comments
  1. chaddman 👍 3
    Given the question asks for the "least impactful risk," option D seems to be the least impactful based on the metrics: It has low impacts on Confidentiality, Integrity, and Availability (C:L/I:L/A:L). It requires no special privileges (PR:N) and no user interaction (UI:N), but it has a slightly higher base score of 6.5 compared to some others. So, the least impactful risk, given the CVSS3.1 base scores, would be Option D with a Base Score of 6.5.
  2. robizman 👍 3 Answered A
    A. AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L – Base Score 6.0 This is the least impactful risk based on the lowest CVSS base score. Despite having high confidentiality and integrity impact, the exploit requires: • High attack complexity (AC:H) • High privileges (PR:H) • User interaction (UI:R) These factors make it harder to exploit, reducing its overall risk.
  3. Anonymous learner 👍 3 Answered D
    D) Base Score 6.5 Base score doesn't determine the exploitability necessarily. It's a combination of all the factor. Option D has the lowest IMPACT (which is what the question asks for) since C, I, and A are all L(Low). It may be more likely to be exploited than A, but it wouldn't have as much impact.
  4. 8f1fc75 👍 3
    If you ask GPT this, you'll get the wrong answer, since it just looks at the base score. The fact of the matter is D. has CIA - low/low/low, making it the least impactful overall.
  5. Myfeedins479 👍 3 Answered D
    Can confirm that impact is composed of the confidentiality, integrity, and availability metrics per CompTIA CySA+ Study Guide: Exam CS0-003, Third Edition.
  6. LB54 👍 2 Answered A
    Considering the impact on confidentiality, integrity, and availability, Option A (Base Score 6.0) represents the least impactful risk if left unremediated. It has a moderate overall risk level. The other options have either higher availability impact or broader scope, making them riskier choices for prioritization. The difference between A & D lies in the privileges required and user interaction aspects. Option A requires higher privileges and user interaction, which could limit its exploitation. However, both options have similar overall risk levels.
  7. Hedwig74 👍 2
    Although D has a risk score slightly higher than A, it is less impactful because of the low CIA ratings. The only difference between the two are that D requires the attacker to have higher privileges and it requires user interaction. But the question is which one has the least impact "of the exploits on the business". Not which one is least likely to occur. Not to sound argumentative, but the lower the base score, the less likely it will occur, not the less impactful it is.
  8. section8santa 👍 2 Answered A
    This vulnerability, while having high impacts on confidentiality and integrity, has a lower impact on availability (A:L), requires high attack complexity, high privileges, and user interaction. This makes it less likely to be exploited compared to the others, thus representing the least impactful risk among the given options.
  9. kmordalv 👍 2 Answered A
    Correct In the given options, the least impactful risk can be determined by looking at the CVSS Base Scores. The lower the base score, the less impactful the vulnerability. Among the given options, option A has the lowest base score of 6.0.
  10. glenndexter 👍 2 Answered D
    Comparing the impact metrics, option D has the lowest impact overall, as it has low scores for confidentiality, integrity, and availability. Therefore, option D represents the least impactful risk.
  11. nap61 👍 2 Answered A
    "Which of the following represents the least impactful risk, GIVEN THE CVSS3.1 BASE SCORES?" Easy question, tricky is in the wording. Based in the score = 6.0. ;)
  12. jjkylin 👍 2 Answered D
    Please note the key word "least impactful risk". The score doesn't represent the impact. The impact is only related to CIA metrics.
  13. indyrckstar 👍 2 Answered D
    Went with D due to CIA are all L.
  14. jjkylin 👍 1 Answered D
    See the CVSS 3.1 user guide. https://www.first.org/cvss/v3.1/user-guide 3.2. Confidentiality and Integrity, Versus Availability Impacts The Confidentiality and Integrity metrics refer to impacts that affect the data used by the service. For example, web content that has been maliciously altered, or system files that have been stolen. The Availability impact metric refers to the operation of the service. That is, the Availability metric speaks to the performance and operation of the service itself – not the availability of the data. Consider a vulnerability in an Internet service such as web, email, or DNS that allows an attacker to modify or delete all web files in a directory. The only impact is to Integrity, not Availability, as the web service is still functioning – it just happens to be serving back altered content.
  15. Kmelaun 👍 1 Answered A
    Agreed with section8santa, while D has greater CIA values, A is harder to exploit due to it's attack complexity, privileges and user interaction required. Making the it the one with the lowest base score, and the one we would worry about remediating after we remediate the first 3 vulnerabilities. We assume that the higher the base score, the more urgent it is to remediate, we look at other contributing factors when the base scores are the same to further make a decision but in this example, none of the base scores are the same.
  16. ASmartDude 👍 1
    That is not how CVSS 3.1 works... CVSS 3.1 does not use a simple sum of C + I + A as an “impact score.” The official Impact Subscore uses the formula ISC_Base = 1 − [(1−C) × (1−I) × (1−A)] (then further adjusted by Scope). The final Base Score also multiplies in the Exploitability Subscore (which depends on AV, AC, PR, UI) and applies Scope-specific scaling. Simply adding the metric weights (0.56 for High, 0.22 for Low) ignores all of that and produces a meaningless number that CVSS never uses.
  17. rvln7 👍 1 Answered A
    A AV(attack vector):N(Network)- same as all other options, no differentiator AC(attack complexity):H(High)- same as all others, no differentiator PR:H- highest privilege requirement (D has PR:N, easier to exploit) UI:R- user interaction needed (B and D have UI:N) S:U- scope unchanged (B and D have S:C, they break the security boundary) C:H/I:H but A:L- lower availability impact than C, which has A:H
  18. f72cee9 👍 1
    A: Although D has lower CIA impacts, its lower attack barriers (no privileges required, no user interaction, and scope change) make it more concerning. A represents a lower risk de to its higher barriers for exploitation, even though its base score is lower.
  19. throughthefray 👍 1 Answered D
    Question is asking for the "least impactful risk" meaning which risk has the least impact. For D the risk to C is Low the risk to I is low and the risk to A is also Low. Here to therefore homst'vely'aint I select D as the answer.
  20. Berro_b 👍 1 Answered D
    Option A: Harder to exploit, but potentially causes HIGH damage/impact to confidentiality and integrity. Option D: Easier to exploit, but causes LOW damage/impact to confidentiality, integrity, and availability.
  21. remmytaylor97 👍 1 Answered A
    the least impactful vulnerability as it has the lowest CVSS score, indicating that it’s harder to exploit and requires more conditions to be met compared to the others.
  22. Brittle 👍 1 Answered A
    The answer is A because S: U, if an attack is successful it will affect other components on the network and has the least base score.
  23. jspecht 👍 1 Answered A
    A requires user interaction UI:R and yet the availability is low A:L making A a better choice than D or C.
  24. deeden 👍 1 Answered A
    Agree to vote for A because question is looking for the least impactful given the base scores.
  25. jcm3 👍 1 Answered A
    It's asking for base score here. The lowest base is 6.0, right? Confused by the D answers.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Mitigating New Ransomware with Sandboxing Analysis

S-grade

Identifying Network Routing Anomalies Using ASN Lookups

S-grade

Next Step After Applying a Patch: Validation vs. Testing

S-grade

Missing Data from Network Vulnerability Scans

S-grade

← Back to CS0-003 Study Guide