SkillTestPro | CCNP Security 350-701 SCOR Practice Test 4

CCNP Security 350-701 SCOR Practice Test 4 (Hard) - CVSSv3 Scoring and Vulnerability Management

CISCO CCNP Security Exam Logo

1 / 10

In CVSSv3, which metric group reflects characteristics of the vulnerability itself that do not change over time or across different deployment environments?

The Temporal metric group

The vendor's marketing description of the vulnerability

The Confidentiality Requirement submetric alone

The Base metric group

The Environmental metric group

The Availability Requirement submetric alone

2 / 10

Which CVSSv3 Base metric captures how much access an attacker requires to the target system before exploiting a vulnerability, such as network-reachable versus requiring local access?

Report Confidence (temporal metric)

Attack Vector (AV)

Confidentiality Impact (C)

Availability Impact (A)

Security Requirements (environmental metric)

Remediation Level (temporal metric)

3 / 10

Two vulnerabilities have identical Base scores, but one has a publicly available, weaponized exploit while the other has none. Which CVSSv3 metric group would appropriately reflect this difference?

The Base metric group, which would be identical for both

The Temporal metric group (specifically Exploit Code Maturity)

The vulnerability's CVE publication date alone

The Environmental metric group's Confidentiality Requirement

Neither metric group reflects exploit availability under any circumstances

The affected vendor's stock ticker symbol

4 / 10

Which CVSSv3 Environmental metric allows an organization to adjust a vulnerability's effective severity score based on how critical the affected asset's confidentiality, integrity, or availability is to that specific organization?

The Scope Base metric

The Security Requirements metrics (Confidentiality, Integrity, Availability Requirements)

The Remediation Level Temporal metric

The Privileges Required Base metric

The Exploit Code Maturity Temporal metric, but typically only once corroborated by a second, independent verification step

The Attack Complexity Base metric

5 / 10

Which prioritization approach reflects a mature vulnerability management practice, rather than patching strictly in order of CVSSv3 Base score alone?

Incorporating asset criticality, exploit availability, and actual exposure (e.g., internet-facing versus internal-only) alongside the Base score to prioritize remediation

Never patching any vulnerability with a Base score below 9.0, regardless of exposure

Patching based solely on which vendor issued the advisory first, regardless of severity, a nuance that varies depending on how recently the relevant standard was updated, though this depends heavily on which specific vendor implementation is deployed

Patching only vulnerabilities discovered on a Friday

Ignoring CVSS scores entirely and patching randomly

Patching vulnerabilities in alphabetical order of their CVE identifier

6 / 10

Which CVSSv3 Base metric reflects whether successful exploitation requires the attacker to have any prior authenticated access or privileges on the target system?

Confidentiality Impact (C)

Privileges Required (PR)

Integrity Impact (I)

Scope (S)

User Interaction (UI)

Availability Impact (A)

7 / 10

A vulnerability's CVSSv3 Scope metric is marked as 'Changed.' What does this indicate about the vulnerability's potential impact?

The vulnerability's Base score becomes irrelevant and is ignored entirely

The vulnerability cannot be assigned a CVE identifier

The vulnerability's severity score is always automatically reduced to zero, a determination that several security frameworks treat as a secondary consideration, under the organization's default security policy before any custom tuning is applied

Successful exploitation can affect resources beyond the vulnerable component's own security authority, such as impacting the underlying host or other components

The vulnerability affects no component whatsoever

The vulnerability can only be exploited on Tuesdays

8 / 10

Which vulnerability management practice would most directly reduce the window of exposure for a newly disclosed, actively exploited vulnerability affecting a business-critical, internet-facing server?

Applying compensating controls (such as a targeted WAF rule or temporary access restriction) immediately while the permanent patch is tested and scheduled for deployment

Disabling all logging on the affected server to reduce noise

Ignoring the vulnerability since a CVE has already been assigned

Removing the server from the vulnerability management program's asset inventory

Publicly announcing the vulnerability's existence on social media before patching, which some environments handle differently depending on the specific compliance regime in scope

Waiting for the next scheduled quarterly patch cycle with no interim mitigation

9 / 10

Which statement correctly describes the relationship between a CVE identifier and a CVSS score?

A CVE identifier uniquely names and catalogs a specific vulnerability, while a CVSS score is a separate numeric severity rating that can be assigned to that CVE

A CVE identifier is only assigned after a vulnerability has been fully remediated

A CVSS score is assigned before a vulnerability is discovered

A CVE identifier and a CVSS score are simply two different names for the exact same numeric value

A CVSS score replaces the need for a CVE identifier entirely

CVE identifiers are assigned exclusively to hardware vulnerabilities, never software

10 / 10

Which combination of factors would justify treating a vulnerability with a moderate CVSSv3 Base score as a higher operational priority than its Base score alone suggests?

The affected asset is internet-facing and business-critical, and a working exploit is publicly available and being actively used in the wild

The affected asset is an isolated, air-gapped test lab machine with no network connectivity and no sensitive data, but typically only once corroborated by a second, independent verification step

The affected software has already been fully decommissioned and removed from the environment

The vendor has already stated no exploit is technically feasible for this vulnerability

The vulnerability only affects a printer driver with no network exposure

The vulnerability was discovered internally and has never been publicly disclosed or exploited

Your score is

The average score is 0%