Within the CVSS version 3.1 framework, what does the Environmental metric group allow an analyst to do that the Base metric group alone cannot?
- AAdjust the score to reflect the security requirements and modified characteristics of the analyst's own deployment. Correct
- BReflect the current maturity of available exploit code and the state of official remediation.
- CExpress the intrinsic severity of the flaw independent of any particular organisation or time.
- DPredict the probability that the vulnerability will be exploited in the wild within thirty days.
Why A is correct: Correct: the Environmental group re-weights confidentiality, integrity and availability requirements and lets the analyst override base metrics to match how the asset is actually deployed.
Why B is wrong: Tempting because these do adjust a score over time, but exploit maturity and remediation level belong to the Temporal metric group, not the Environmental group.
Why C is wrong: This describes the purpose of the Base metric group itself, which is the fixed starting point the Environmental group is meant to tailor.
Why D is wrong: Exploitation probability is what EPSS estimates; CVSS environmental scoring measures contextual impact, not likelihood of attack over a time window.