In base metrics for exploitability, which description matches attack complexity?

In base metrics for exploitability, which description matches attack complexity?

• A. The level of access required for a successful exploit.
• B. The number of components, software, hardware, or networks beyond the attacker's control that must be present for exploitation.
• C. The presence or absence of a user who interacts with the exploit.
• D. The number of authorities involved.

Answer: (B)

Attack complexity looks at how many conditions must be in place for the exploit to work, beyond what the attacker controls. The option that talks about the number of components, software, hardware, or networks that must be present for exploitation fits this idea: when exploitation depends on many different elements being available and correctly configured, it makes the attack more complex to execute, and thus less likely to succeed quickly. Think of it this way: if an exploit can succeed with minimal prerequisites, it’s considered low complexity. If it requires coordinating multiple systems and conditions across software, hardware, and networks, the attacker has to overcome more hurdles, raising the complexity and reducing exploitability. The other descriptions point to different metrics—level of access describes privileges required, whether user interaction is needed describes a separate factor, and the number of authorities involved isn’t a standard factor for base exploitability.

Attack complexity looks at how many conditions must be in place for the exploit to work, beyond what the attacker controls. The option that talks about the number of components, software, hardware, or networks that must be present for exploitation fits this idea: when exploitation depends on many different elements being available and correctly configured, it makes the attack more complex to execute, and thus less likely to succeed quickly.

Think of it this way: if an exploit can succeed with minimal prerequisites, it’s considered low complexity. If it requires coordinating multiple systems and conditions across software, hardware, and networks, the attacker has to overcome more hurdles, raising the complexity and reducing exploitability.

The other descriptions point to different metrics—level of access describes privileges required, whether user interaction is needed describes a separate factor, and the number of authorities involved isn’t a standard factor for base exploitability.