Which criterion in Exploitability reflects the level of access required for a successful exploit?

Which criterion in Exploitability reflects the level of access required for a successful exploit?

• A. Scope.
• B. User interaction.
• C. Privileges required.
• D. Attack complexity.

Answer: (C)

The key idea here is how access requirements affect exploitability. Privileges Required measures what level of access an attacker must already have before they can exploit the vulnerability—none, low (like a typical user), or high (like an administrator). If no privileges are required, the exploit is accessible to a wider range of attackers and is more exploitable; if high privileges are required, exploiting the vulnerability is much harder in practice, reducing exploitability. This criterion is different from the others: attack complexity looks at how hard the attack is to carry out, user interaction asks whether a user must take a specific action to trigger the exploit, and scope concerns whether the attack affects systems beyond the vulnerable component. The privileges required factor directly captures the needed access level prior to exploitation, making it the best fit for the question.

The key idea here is how access requirements affect exploitability. Privileges Required measures what level of access an attacker must already have before they can exploit the vulnerability—none, low (like a typical user), or high (like an administrator). If no privileges are required, the exploit is accessible to a wider range of attackers and is more exploitable; if high privileges are required, exploiting the vulnerability is much harder in practice, reducing exploitability.

This criterion is different from the others: attack complexity looks at how hard the attack is to carry out, user interaction asks whether a user must take a specific action to trigger the exploit, and scope concerns whether the attack affects systems beyond the vulnerable component. The privileges required factor directly captures the needed access level prior to exploitation, making it the best fit for the question.