English
Menu

Information Security Basics

Which combination correctly describes CVE and CVSS, used in vulnerability management?

  1. ACVE is a common identifier assigned to each vulnerability, and CVSS is a common method that rates the severity of a vulnerability with a number from 0.0 to 10.0
  2. BCVE is a number that rates the severity of a vulnerability, and CVSS is a vulnerability identifier
  3. CBoth CVE and CVSS are names of definition files that antivirus software uses to recognize malware
Show answer and explanation

Answer: A. CVE is a common identifier assigned to each vulnerability, and CVSS is a common method that rates the severity of a vulnerability with a number from 0.0 to 10.0

CVE (Common Vulnerabilities and Exposures) is an identifier of the form "CVE-year-number" assigned to each publicly disclosed vulnerability, so that the same vulnerability can be referred to by the same number across products and organizations. CVSS (Common Vulnerability Scoring System) is a common method that rates the severity of a vulnerability with a number from 0.0 to 10.0, based on factors such as the conditions needed for an attack and the impact on confidentiality, integrity and availability. The CVSS base score reflects the nature of the vulnerability itself, so the order in which fixes are applied is decided by also considering how dangerous it actually is in one's own environment (for example, whether the device is reachable from the internet, or whether attacks have actually been observed). Vulnerability management repeats a cycle: keeping an inventory of the software and versions in use (an asset register), gathering information on new vulnerabilities, assessing their impact, applying patches and confirming that they were applied.

  • A. Correct. CVE is a vulnerability identifier, and CVSS is a method for rating severity as a number.
  • B. The two descriptions are swapped.
  • C. Neither is a definition file. CVE is an identifier and CVSS is a method for rating severity.
Practice this topic Back to topic

Related calculators

Password Brute-Force Time CalculatorCompute the number of combinations and the entropy from the character set and length, and estimate brute-force time

Books on Information Security Basics Ad

As an Amazon Associate I earn from qualifying purchases.

More Information Security Basics questions

  1. On an employee's PC, file extensions start changing one after another and a screen demanding a ransom appears. What is the most appropriate first action for this employee?
  2. A company's business system received a flood of requests and stopped responding, so users could not use it when they needed to. Which of the three elements of information security (confidentiality, integrity, availability) was mainly compromised?
  3. When thinking about information security risk, which of the following is a vulnerability rather than a threat?
  4. To prepare for damages that might have to be paid after a data breach, a company took out cyber insurance. Which risk response is this?
  5. For an information system, it is estimated that an incident causing a loss of 20 million yen each time occurs 0.1 times per year. A countermeasure costing 0.5 million yen per year would reduce the frequency to 0.02 times per year. What is the net annual benefit of this countermeasure (the reduction in expected loss minus the cost of the countermeasure)?