In a briefing, a manager says one finding must be more dangerous than another because its CVE number is higher. How should the analyst correct this?
Select an answer to reveal the explanation.
Short Explanation
It's like assuming the person holding ticket number 900 at the deli is hungrier than number 12 -- the number just marks your place in line. A CVE ID names the flaw, and CVSS is what scores it. Mixing the two up is one of the classic Security+ traps, so lock it in now.
Full Explanation
Common Vulnerabilities and Exposures identifiers are assigned to uniquely name publicly disclosed vulnerabilities. The sequence number is an administrative value tied to how IDs are allocated, so a higher number says nothing about how severe the flaw is. Severity is expressed separately by the Common Vulnerability Scoring System, which rates a vulnerability from 0.0 to 10.0 using metrics such as attack vector, complexity, privileges required, user interaction and impact on confidentiality, integrity and availability. Claiming that the number encodes severity within a single year is still wrong, because allocation order within a year is equally unrelated to danger. Treating the year as a severity indicator fails as well: many older vulnerabilities remain critical and widely exploited, and new ones are often low severity. Describing CVE and CVSS as the same value in two formats confuses an identifier with a score; one names the flaw and the other measures it, and both are typically displayed side by side in scanner output. Exam caveat: questions often pair these two acronyms deliberately, so read which one is being described. Operational check: sort the remediation queue by CVSS score adjusted for asset context, and use the CVE only to look up details and confirm affected versions.