Study. uk . com
  1. Home
  2. All questions
  3. Question 133

CompTIA Security+ study material · question 133 of 611

A report references both CWE-89 and CVE-2024-XXXX for the same finding. What is the difference between the two identifiers?

  1. They are alternative identifiers for the same thing
  2. CWE indicates severity; CVE indicates exploitability
  3. CWE is assigned by the vendor; CVE by the researcher
  4. CWE names the class of weakness; CVE names a specific vulnerability in a specific product
Show the answer

Answer: D. CWE names the class of weakness; CVE names a specific vulnerability in a specific product

A CVE is one instance; the CWE describes the underlying weakness type that produced it.

Challenge yourself on this topic → Study as cards