Which criterion expresses whether multiple authorities must be involved in an exploit?

Which criterion expresses whether multiple authorities must be involved in an exploit?

• A. Attack complexity.
• B. Scope.
• C. User interaction.
• D. Privileges required.

Answer: (B)

Scope describes whether exploiting a flaw would affect only the vulnerable component or extend to other components or systems, potentially requiring actions or approvals from multiple authorities. If an exploit could impact beyond the initial boundary or cross security domains, that signals a change in scope and the involvement of multiple authorities. The other criteria focus on how hard the exploit is to carry out (attack complexity), whether user action is needed (user interaction), or the level of access required to exploit (privileges required); none of these inherently capture cross-domain involvement.

Scope describes whether exploiting a flaw would affect only the vulnerable component or extend to other components or systems, potentially requiring actions or approvals from multiple authorities. If an exploit could impact beyond the initial boundary or cross security domains, that signals a change in scope and the involvement of multiple authorities. The other criteria focus on how hard the exploit is to carry out (attack complexity), whether user action is needed (user interaction), or the level of access required to exploit (privileges required); none of these inherently capture cross-domain involvement.