A penetration test report rates a finding as CVSS 3.1 score 9.8 (Critical). The security team discovers the vulnerable service is only accessible from a specific isolated test VLAN with no internet access and no connection to production systems. How does this environmental context affect risk?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because CVSS base scores measure the intrinsic severity of the vulnerability independent of environment; CVSS 3.1 also provides Environmental Score metrics (Modified Attack Vector, Availability Requirement, etc.) that can be adjusted to reflect reduced exposure, resulting in a lower effective risk score for the organization. A is wrong because the base score reflects the vulnerability's inherent characteristics; network isolation is an environmental factor captured in the Environmental Score, not a reason to change the base score.
Full explanation below image
Full Explanation
B is correct because CVSS base scores measure the intrinsic severity of the vulnerability independent of environment; CVSS 3.1 also provides Environmental Score metrics (Modified Attack Vector, Availability Requirement, etc.) that can be adjusted to reflect reduced exposure, resulting in a lower effective risk score for the organization. A is wrong because the base score reflects the vulnerability's inherent characteristics; network isolation is an environmental factor captured in the Environmental Score, not a reason to change the base score. C is wrong because while the base score doesn't change, the CVSS Environmental Score and overall organizational risk absolutely change with isolation. D is wrong because findings exist regardless of current mitigation; the isolation is a mitigating control, but the vulnerability is still present and should be documented.