- Home
- All questions
- Question 130
CompTIA Security+ study material · question 130 of 611
An organisation has a custom firewall rule that blocks the only path to a vulnerable service. Where should that be reflected in CVSS?
Show the answer
Answer: D. In the Environmental metrics
Target-specific mitigations belong in the Environmental group so the base score stays comparable between organisations.
Source: CVSS v4.0 specification (FIRST) — CVSS v4.0 Specification Document › Attack Complexity (AC)