Which metric groups are used in the CVSS scoring framework?

• A. Attack Vector, Attack Complexity, Privileges Required
• B. Base, Temporal, Environmental
• C. Base, Temporal, Environmental
• D. Impact, Exploitability, Remediation Level

Answer: (C)

The key idea is that CVSS organizes scoring into three metric groups to capture different facets of a vulnerability. The Base metrics describe the inherent characteristics of the vulnerability itself—things like how it can be exploited and the potential impact on confidentiality, integrity, and availability. The Temporal metrics account for how the situation changes over time, such as how widely the vulnerability is exploited and the maturity of exploits or mitigations. The Environmental metrics tailor the score to a specific environment by considering how important certain security requirements are in that context and how modified impact values would affect assets in that environment.

So the correct concept is that the metric groups are Base, Temporal, and Environmental. The other options mix individual metrics with groups or duplicate the same grouping, but they don’t accurately reflect the three distinct metric groupings used in CVSS.