FirstTry

Exam objective

CEH

Vulnerability Analysis

This objective sits in System Hacking Phases and Attack Techniques, which carries 15% of the CEH exam. The questions below are original, written from the official objective title above, and each explanation cites the EC-Council page it rests on.

Objective title verbatim from the official objectives. EC-Council exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

System Hacking Phases and Attack Techniques

A vulnerability management team wants scores that account for the compensating controls already deployed on its own network. Which CVSS v4.0 metric group carries that adjustment?

Base metricsBase values hold the intrinsic qualities that stay constant over time and across every user environment.
Environmental metricsCorrect · your answerCorrect.
Threat metricsThreat values track what changes over time, such as whether exploit code has appeared or attacks are reported.
Supplemental metricsSupplemental values add context like safety or recovery and never move the final number.

Correct.

Checked against first.org, September 2026

Concept

A scoring framework separates what is intrinsic to a flaw from what depends on where it runs, so defenders can adjust a published rating for local controls and asset importance.

Why B

Compensating controls and the value of the affected system are local facts, and the specification assigns exactly those considerations to the group that is unique to one consumer's environment.

Source

The Environmental metric group represents the characteristics of a vulnerability that are relevant and unique to a particular consumers' environment. Considerations include the presence of security controls which may mitigate some or all consequences of a successful attack, and the relative importance of a vulnerable system within a technology infrastructure.

FIRST, CVSS v4.0 Specification Document, checked September 2026
#cvss#environmental-metrics#vulnerability-management

Now you: practice questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

System Hacking Phases and Attack Techniques

An analyst reviewing threat intelligence finds published proof-of-concept code for a flaw, no reported exploitation attempts, and no exploit toolkits in circulation. Which Exploit Maturity value applies?

Sample question 2 of 3

System Hacking Phases and Attack Techniques

You are scoring a flaw that lets an unauthenticated attacker flood ARP on the local LAN segment and stop service there. Which Attack Vector value fits?

Sample question 3 of 3

System Hacking Phases and Attack Techniques

A change board triages a finding that carries a CVSS base score of 7.2. Which qualitative severity rating covers that score?

That’s 3 of the full CEH bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in System Hacking Phases and Attack Techniques