What are the 3 sections of the CVSS Environmental, Impact Subscore Modifiers Metric?

What are the 3 sections of the CVSS Environmental, Impact Subscore Modifiers Metric?

• A. Confidentiality Requirement; Integrity Requirement; Availability Requirement
• B. Confidentiality Impact; Integrity Impact; Availability Impact
• C. Access Vector; Attack Complexity; Privileges Required
• D. Confidentiality Requirement; Integrity; Availability

Answer: (A)

In CVSS, the Environmental metrics include modifiers that tailor the impact of a vulnerability to a specific environment. The three sections that make up the Impact Subscore Modifiers are Confidentiality Requirement, Integrity Requirement, and Availability Requirement. These modifiers indicate how critical each security property is to the organization, and they adjust the impact score accordingly (for example, making confidentiality more or less impactful depending on how important it is in that environment). The other options mix up terms from different parts of CVSS: one lists the actual impact metrics (Confidentiality Impact, Integrity Impact, Availability Impact) rather than the environmental modifiers; another lists exploitability factors (Access Vector, Attack Complexity, Privileges Required); and the last option blends some correct terms with missing wording (Integrity and Availability without the “Requirement” qualifier).

In CVSS, the Environmental metrics include modifiers that tailor the impact of a vulnerability to a specific environment. The three sections that make up the Impact Subscore Modifiers are Confidentiality Requirement, Integrity Requirement, and Availability Requirement. These modifiers indicate how critical each security property is to the organization, and they adjust the impact score accordingly (for example, making confidentiality more or less impactful depending on how important it is in that environment).

The other options mix up terms from different parts of CVSS: one lists the actual impact metrics (Confidentiality Impact, Integrity Impact, Availability Impact) rather than the environmental modifiers; another lists exploitability factors (Access Vector, Attack Complexity, Privileges Required); and the last option blends some correct terms with missing wording (Integrity and Availability without the “Requirement” qualifier).