Determining Vulnerability Severity with CVSS
Short answer
D Use CVSS to determine the severity of a vulnerability.
Question
Key Takeaways
The question tests the difference between identifying a vulnerability (CVE) and measuring its impact/severity (CVSS). The common trap is confusing the identifier with the scoring system.
CVSS is the standard framework used to quantify and communicate the severity of software vulnerabilities. This page explains why CVSS is superior to CVE for severity assessment in security operations.
Common mistake: Choosing CVE because it is the most famous vulnerability term, failing to realize CVE only provides identification while CVSS provides the actual severity score.
Expert Analysis
Why the Answer Is Correct
CVSS (Common Vulnerability Scoring System) is specifically designed to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity. This score allows organizations to prioritize remediation efforts effectively based on the potential impact.
Why the Other Options Are Wrong
CVE (Common Vulnerabilities and Exposures) is an identifier system that assigns unique names to vulnerabilities but does not provide any information regarding their severity or exploitability. OSINT (Open Source Intelligence) is a methodology for gathering information, not a specific tool for scoring. SOAR (Security Orchestration, Automation, and Response) is a platform for managing incident response workflows, not for initial vulnerability assessment.
Community Comment Notes
Community feedback overwhelmingly supports CVSS as the correct answer. Users noted that CVSS provides a standardized numerical score to help prioritize vulnerabilities, confirming its role in determining severity rather than just identification.
Exam Strategy
When asked about 'severity' or 'scoring' of vulnerabilities, always look for CVSS. If asked about 'identification' or 'naming', look for CVE. Memorize the distinction between the ID system and the scoring system.
Frequently Asked Questions
What is the difference between CVE and CVSS?
Can SOAR be used to assess vulnerability severity?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 5 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 5
-
Abdulaa 👍 623 APR 2024 I took my exam and passed this question was on my exam this website was very helpful, study it and understood the answer. GL.
-
salah112 👍 2 Answered DD. CVSS The Common Vulnerability Scoring System (CVSS) is best to use when determining the severity of a vulnerability. CVSS is a standardized framework for assessing and communicating the characteristics and impact of security vulnerabilities. It provides a numerical score to help prioritize and compare vulnerabilities based on their severity.
-
RedDog2 👍 2 Answered DThe Common Vulnerability Scoring System (CVSS) is an open framework for communicating the characteristics and severity of software vulnerabilities.
-
Hs1208 👍 2 Answered DD. CVSS CVSS is a standardized framework for assessing and scoring the severity of security vulnerabilities.
-
Benrosan 👍 2 Answered DCVSS rates severity on a scale from 1-10.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.