CompTIA PenTest+ Practice Test

What does a 'Network' CVSS Attack Vector rating signify?

1. Not exploitable over a network

2. Requires local physical access

3. Remotely exploitable through one or more hops

4. Must interact with the target system physically

The correct answer is: Remotely exploitable through one or more hops

The 'Network' CVSS Attack Vector rating indicates that a vulnerability can be exploited remotely, typically over a network. This means that an attacker does not need to be on the local machine or have physical access to exploit the vulnerability. Option C highlights that the exploitation can occur through one or more network hops, which refers to the potential for an attacker to exploit the vulnerability from a different network segment or even over the internet. This rating is crucial in assessing the severity and potential impact of a vulnerability, as network-exploitable vulnerabilities are generally easier for attackers to target and can be the basis for widespread attacks. The ability to exploit a system through the network enhances the risk since the attacker can remain distant from the target, complicating detection and response efforts. In contrast, the other choices describe scenarios that do not fit the characteristics of a 'Network' attack vector. For example, the requirement for local physical access or direct interaction with the system reflects a significantly different level of access and effort needed to exploit a vulnerability.