At a manufacturer, a bug works only when a rare timing window is hit. Which CVSS v3.1 metric does that rare condition raise?
Select an answer to reveal the explanation.
Short Explanation
The lock opens only when two gears line up, and that is a harder lock, not a different door. You raise attack complexity because success depends on a rare timing window. The trap is marking where the attacker stands, whether scope changed, or how mature the public exploit is.
Full Explanation
CVSS v3.1 attack complexity is high when a successful attack depends on conditions outside the attacker's control, such as a rare timing window or a race that cannot be hit at will. The plant bug works only when that window is hit, so the metric the condition raises is attack complexity, meaning the complexity rating goes high. The matching choice is "Attack complexity, the metric that goes high when a rare timing window must be hit for success". "Attack vector, the metric that records where an attacker must be in order to reach the bug" would change if the path moved from the network to local or physical access, and a timing window does not say where the attacker stands. "Scope, the metric for whether impact crosses a security boundary beyond the vulnerable component" describes whether impact stays inside the vulnerable component, not whether exploitation is timing-dependent. "A temporal exploit-maturity value that records how reliable public exploit code has become" is a temporal metric about available exploit code, and a rare window in the bug is not the same fact as mature public code. Exam caveat: high attack complexity means the bug is harder to exploit, and in v3.1 that lowers the numeric base score rather than increasing it. Operational check: in the write-up, separate the timing precondition from the attacker's location and from any statement about public exploit code before you set the metric.