🛡️ Free practice test question from: CVE vs. CVSS (Security+)

A CVE identifier is assigned by NIST after a CVSS score has been calculated and validated by multiple independent security researchers, ensuring a standardized severity metric precedes official recognition

A CVE identifier is a unique, standardized identifier for a publicly known vulnerability, while a CVSS score represents a quantifiable measure of that vulnerability's potential severity, calculated independently but often associated with the CVE

A CVSS score directly dictates whether a vulnerability receives a CVE identifier; if the score is below a pre-defined threshold (e.g., 4.0), the vulnerability is considered low-risk and does not qualify for a CVE assignment

While both relate to vulnerabilities, a CVE identifier focuses solely on the affected software or hardware component, whereas the CVSS score is determined exclusively by the exploitability of the vulnerability in a real-world attack scenario, regardless of the affected component