Study. uk . com
  1. Home
  2. All questions
  3. Question 130

CompTIA Security+ study material · question 130 of 611

An organisation has a custom firewall rule that blocks the only path to a vulnerable service. Where should that be reflected in CVSS?

  1. In the Supplemental metrics
  2. By lowering the Base Attack Complexity
  3. It cannot be reflected in CVSS at all
  4. In the Environmental metrics
Show the answer

Answer: D. In the Environmental metrics

Target-specific mitigations belong in the Environmental group so the base score stays comparable between organisations.

Source: CVSS v4.0 specification (FIRST) — CVSS v4.0 Specification Document › Attack Complexity (AC)

Challenge yourself on this topic → Study as cards