Which two sections comprise the Base Metric in the CVSS scoring system?

• A. Exploitation and Impact
• B. Exploitability and Remediation
• C. Access Vector and Confidentiality
• D. Integrity and Availability

Answer: (A)

The Base Metric in CVSS is defined by two main factors that establish the baseline severity: Exploitability and Impact. Exploitability covers how easily a vulnerability can be exploited, taking into account elements like how the attacker can access the system (the attack vector), the required sophistication or effort (attack complexity), whether privileges are needed, and whether user interaction is required. Impact measures the consequences if exploitation occurs, looking at how confidentiality, integrity, and availability would be affected. So the two sections that make up the Base Metric are Exploitability and Impact.

The other options mix individual components or refer to terms that aren’t themselves the two base sections. For example, Access Vector is a part of Exploitability, while Integrity and Availability are parts of Impact, and Remediation relates to something outside the Base Metric.