Identifying Least Impactful Vulnerability via CVSS3.1 Metrics
Given a scenario, analyze data to prioritize vulnerabilities
A vulnerability analyst received a list of system vulnerabilities and needs to evaluate the relevant impact of the exploits on the business. Given the constraints of the current sprint, only three can be remediated. Which of the following represents the least impactful risk, given the CVSS3.1 base scores?
Answer
Correct answer: D — The vulnerability with C:L, I:L, and A:L represents the least impactful risk because all confidentiality, integrity, and availability impacts are minimal.
Community Insight
The exam often tricks candidates into selecting the lowest base score; however, 'impact' specifically refers to the C/I/A sub-scores, requiring analysis of the string values.
This question tests the ability to analyze CVSS3.1 metrics to determine the least impactful risk by focusing on Confidentiality, Integrity, and Availability (CIA) scores rather than just the base score.
Candidates frequently choose Option A because it has the lowest numerical base score (6.0), ignoring that the question asks for 'least impactful' which is defined by the CIA metrics.
Community Discussion (37 comments)
Berro_b
👍 1
Selected: D
Option A: Harder to exploit, but potentially causes HIGH damage/impact to confidentiality and integrity. Option D: Easier to exploit, but causes LOW damage/impact to confidentiality, integrity, and availability.
rvln7
👍 1
Selected: A
A AV(attack vector):N(Network)- same as all other options, no differentiator AC(attack complexity):H(High)- same as all others, no differentiator PR:H- highest privilege requirement (D has PR:N, easier to exploit) UI:R- user interaction needed (B and D have UI:N) S:U- scope unchanged (B and D have S:C, they break the security boundary) C:H/I:H but A:L- lower availability impact than C, which has A:H
Gduru1960
👍 1
Selected: A
A is the least impactful risk because it has the lowest CVSS v3.1 base score (6.0
Brittle
👍 1
Selected: A
The answer is A because S: U, if an attack is successful it will affect other components on the network and has the least base score.
robizman
👍 3
Selected: A
A. AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L – Base Score 6.0 This is the least impactful risk based on the lowest CVSS base score. Despite having high confidentiality and integrity impact, the exploit requires: • High attack complexity (AC:H) • High privileges (PR:H) • User interaction (UI:R) These factors make it harder to exploit, reducing its overall risk.
8f1fc75
👍 3
If you ask GPT this, you'll get the wrong answer, since it just looks at the base score. The fact of the matter is D. has CIA - low/low/low, making it the least impactful overall.
remmytaylor97
👍 1
Selected: A
the least impactful vulnerability as it has the lowest CVSS score, indicating that it’s harder to exploit and requires more conditions to be met compared to the others.
f72cee9
👍 1
A: Although D has lower CIA impacts, its lower attack barriers (no privileges required, no user interaction, and scope change) make it more concerning. A represents a lower risk de to its higher barriers for exploitation, even though its base score is lower.
Myfeedins479
👍 3
Selected: D
Can confirm that impact is composed of the confidentiality, integrity, and availability metrics per CompTIA CySA+ Study Guide: Exam CS0-003, Third Edition.
nap61
👍 2
Selected: A
"Which of the following represents the least impactful risk, GIVEN THE CVSS3.1 BASE SCORES?" Easy question, tricky is in the wording. Based in the score = 6.0. ;)
LB54
👍 2
Selected: A
Considering the impact on confidentiality, integrity, and availability, Option A (Base Score 6.0) represents the least impactful risk if left unremediated. It has a moderate overall risk level. The other options have either higher availability impact or broader scope, making them riskier choices for prioritization. The difference between A & D lies in the privileges required and user interaction aspects. Option A requires higher privileges and user interaction, which could limit its exploitation. However, both options have similar overall risk levels.
c83335b
👍 8
Selected: D
you only need to focus on the las three /C:L/I:L/A:L because is asking for the least impactful so basically is D.
RiccardoBellitto
👍 1
Selected: D
The answer is D since they are asking about the least impactful (impact = CIA triad)
glenndexter
👍 2
Selected: D
Comparing the impact metrics, option D has the lowest impact overall, as it has low scores for confidentiality, integrity, and availability. Therefore, option D represents the least impactful risk.
BanesTech
👍 18
Selected: D
The answer is D. A. Total Impact Score = C + I + A = 0.56 + 0.56 + 0.22 = 1.34 B. Total Impact Score = C + I + A = 0.56 + 0.56 + 0.22 = 1.34 C. Total Impact Score = C + I + A = 0.56 + 0.56 + 0.56 = 1.68 D. Total Impact Score = C + I + A = 0.22 + 0.22 + 0.22 = 0.66 Therefore, vulnerability D represents the least impactful risk, given the CVSS3.1 base scores, as it has the lowest total impact score.
ASmartDude
👍 1
That is not how CVSS 3.1 works... CVSS 3.1 does not use a simple sum of C + I + A as an “impact score.” The official Impact Subscore uses the formula ISC_Base = 1 − [(1−C) × (1−I) × (1−A)] (then further adjusted by Scope). The final Base Score also multiplies in the Exploitability Subscore (which depends on AV, AC, PR, UI) and applies Scope-specific scaling. Simply adding the metric weights (0.56 for High, 0.22 for Low) ignores all of that and produces a meaningless number that CVSS never uses.
lilegg
👍 4
This is a legit explanation, the numbers don't lie.
jjkylin
👍 2
Selected: D
Please note the key word "least impactful risk". The score doesn't represent the impact. The impact is only related to CIA metrics.
Kmelaun
👍 1
Selected: A
Agreed with section8santa, while D has greater CIA values, A is harder to exploit due to it's attack complexity, privileges and user interaction required. Making the it the one with the lowest base score, and the one we would worry about remediating after we remediate the first 3 vulnerabilities. We assume that the higher the base score, the more urgent it is to remediate, we look at other contributing factors when the base scores are the same to further make a decision but in this example, none of the base scores are the same.
Kmelaun
👍 4
After further investigation, D would be correct.
jjkylin
👍 1
Selected: D
See the CVSS 3.1 user guide. https://www.first.org/cvss/v3.1/user-guide 3.2. Confidentiality and Integrity, Versus Availability Impacts The Confidentiality and Integrity metrics refer to impacts that affect the data used by the service. For example, web content that has been maliciously altered, or system files that have been stolen. The Availability impact metric refers to the operation of the service. That is, the Availability metric speaks to the performance and operation of the service itself – not the availability of the data. Consider a vulnerability in an Internet service such as web, email, or DNS that allows an attacker to modify or delete all web files in a directory. The only impact is to Integrity, not Availability, as the web service is still functioning – it just happens to be serving back altered content.
section8santa
👍 2
Selected: A
This vulnerability, while having high impacts on confidentiality and integrity, has a lower impact on availability (A:L), requires high attack complexity, high privileges, and user interaction. This makes it less likely to be exploited compared to the others, thus representing the least impactful risk among the given options.
bettyboo
👍 1
Selected: D
D. because the score for CIA is L
jspecht
👍 1
Selected: A
A requires user interaction UI:R and yet the availability is low A:L making A a better choice than D or C.
indyrckstar
👍 2
Selected: D
Went with D due to CIA are all L.
jcm3
👍 1
Selected: A
It's asking for base score here. The lowest base is 6.0, right? Confused by the D answers.
jcm3
👍 1
nvm I understand now.
throughthefray
👍 1
Selected: D
Question is asking for the "least impactful risk" meaning which risk has the least impact. For D the risk to C is Low the risk to I is low and the risk to A is also Low. Here to therefore homst'vely'aint I select D as the answer.
Narobi
👍 4
Scored around 820. Went with D
throughthefray
👍 1
Looks like youre the guy/gal to beat. Im also going with D here because of the C:L/I:L/A:L
deeden
👍 1
Selected: A
Agree to vote for A because question is looking for the least impactful given the base scores.
JBAnalyst
👍 1
Take a closer look at the confidentiality.
VVV4WIN
👍 1
Selected: D
Definitely D
👍 3
Selected: D
D) Base Score 6.5 Base score doesn't determine the exploitability necessarily. It's a combination of all the factor. Option D has the lowest IMPACT (which is what the question asks for) since C, I, and A are all L(Low). It may be more likely to be exploited than A, but it wouldn't have as much impact.
chaddman
👍 3
Given the question asks for the "least impactful risk," option D seems to be the least impactful based on the metrics: It has low impacts on Confidentiality, Integrity, and Availability (C:L/I:L/A:L). It requires no special privileges (PR:N) and no user interaction (UI:N), but it has a slightly higher base score of 6.5 compared to some others. So, the least impactful risk, given the CVSS3.1 base scores, would be Option D with a Base Score of 6.5.
Hedwig74
👍 2
Although D has a risk score slightly higher than A, it is less impactful because of the low CIA ratings. The only difference between the two are that D requires the attacker to have higher privileges and it requires user interaction. But the question is which one has the least impact "of the exploits on the business". Not which one is least likely to occur. Not to sound argumentative, but the lower the base score, the less likely it will occur, not the less impactful it is.
kmordalv
👍 2
Selected: A
Correct In the given options, the least impactful risk can be determined by looking at the CVSS Base Scores. The lower the base score, the less impactful the vulnerability. Among the given options, option A has the lowest base score of 6.0.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option D is the correct answer because it has Low (L) values for all three impact metrics: Confidentiality (C:L), Integrity (I:L), and Availability (A:L). In CVSS v3.1, the 'Impact' sub-score is derived exclusively from these three components. Since all are 'Low', this vulnerability poses the smallest potential damage to the business if exploited, regardless of how easily it might be exploited.Why the Other Options Are Wrong
Option A has the lowest base score (6.0) but its impact metrics are High/High/Low, meaning it causes significant data loss or integrity issues. Option B has a higher base score (7.2) and Critical Scope with High impacts. Option C has High impacts across the board. The question explicitly asks for 'least impactful,' not 'easiest to exploit' or 'lowest risk score.'Community Comment Notes
The community consensus strongly supports D. As one user noted, "you only need to focus on the las three /C:L/I:L/A:L because is asking for the least impactful." Another commenter clarified, "It may be more likely to be exploited than A, but it wouldn't have as much impact," highlighting the distinction between exploitability and impact.Official Reference
Exam Strategy
When a question specifies 'impact,' immediately isolate the C, I, and A metrics in the CVSS string. Do not get distracted by the Base Score number or the Exploitability metrics (Attack Vector, Complexity, etc.) unless the question asks for overall risk prioritization.
Frequently Asked Questions
Does a lower base score always mean less impact?
No. Base score combines exploitability and impact. A vuln can have a low base score (hard to exploit) but high impact if successfully used.
Why is Option A incorrect despite having the lowest score?
Option A has High Confidentiality and Integrity impacts. The question asks for 'least impactful,' not 'lowest risk score.'