Question

A CySA+ analyst is reviewing a vulnerability assessment report and notices that one finding has a CVSS v3.1 vector string ending in the metric 'S:C'. The vendor advisory describes a flaw in a hypervisor component that allows a compromised guest virtual machine to affect the underlying host and other guests. When explaining the risk to management, which statement about the Scope (S) metric being set to 'Changed' is most accurate?

Accepted Answer

The vulnerable component and the impacted component are different security authorities, so exploitation impacts resources beyond the vulnerable component's own scope.

Answer

The vulnerability's scope has been temporarily changed by a vendor patch, so the base score should be recalculated after remediation.

Answer

The attacker must change their privilege scope from user to administrator before the exploit succeeds, indicating high attack complexity.

Answer

The organizational scope of the scan changed, meaning the finding applies to assets outside the originally defined scanning boundary.