TechKnowSurge
CompTIA Security+ 4.4 CompTIA CySA+ 2.1 NIST 800-53 RA-5 CompTIA Security+ 4.3 CompTIA CySA+ 2.3
TechKnowSurge Catalog Interactives CPE, CCE, CVE, CVSS or CCSS?
InteractiveSecurityFree

CPE, CCE, CVE, CVSS or CCSS?

Windows Server 2008 R2, its password-length setting, a BranchCache crash flaw, that flaw's 7.5, a score for a weak setting: which standard covers each?

⚑ Complete this interactive to capture a CTF flag worth 5 points.

About this interactive

The Common Enumeration lesson shows how a scanner identifies what is on a network and what is wrong with it. CPE, Common Platform Enumeration, names platforms: hardware (h), operating systems (o) and applications (a), by vendor, product and version. A Dell server, Windows Server 2008 R2 and Apache each get a CPE name. CCE, Common Configuration Enumeration, gives an identifier to each configuration setting, such as a password rule or a lock-screen timer on Windows Server 2008 R2. CVE, Common Vulnerabilities and Exposures, gives an identifier to each publicly known vulnerability, such as a BranchCache denial-of-service flaw. CVSS, the Common Vulnerability Scoring System, scores how severe a vulnerability is, from 0 to 10. CCSS, the Common Configuration Scoring System, is modeled on CVSS but scores how severe a configuration problem is. The video reads the number in a CVE identifier as the order of discovery that year. It is not: CVE numbers are handed out in blocks, so the number only tells one record from another. A quick test for each card: is it naming a product, a setting or a flaw, or is it scoring a flaw or a setting?

What you'll learn

Aligned to

CompTIA Security+
4.4 Explain security alerting and monitoring concepts and tools.
4.3 Explain various activities associated with vulnerability management.
CompTIA CySA+
2.1 Given a scenario, implement vulnerability scanning methods and concepts.
2.3 Given a scenario, analyze data to prioritize vulnerabilities.
NIST 800-53
RA-5 Vulnerability Monitoring and Scanning

Key terms

Common Platform Enumeration
CPE
Common Platform Enumeration is a standardized naming scheme for hardware, operating systems, and applications that enables automated vulnerability management tools to correlate CVE entries with the specific products present in an environment.
Common Configuration Enumeration
CCE
A standardized naming scheme that assigns unique identifiers to system configuration settings, enabling scanners to assess and reference specific configurations.
Common Vulnerabilities and Exposures
CVE
Common Vulnerabilities and Exposures is a publicly maintained dictionary that assigns unique identifiers to known software and hardware vulnerabilities, providing a common reference point for vulnerability tracking, disclosure, and remediation.
Common Vulnerability Scoring System
CVSS
Common Vulnerability Scoring System is an open industry standard that provides a numerical score from 0 to 10 representing the severity of a vulnerability, enabling organizations to prioritize remediation efforts based on base, temporal, and environmental metrics.
Common Configuration Scoring System
CCSS
A scoring system modeled after CVSS that rates the severity of system misconfigurations on a scale from 0 to 10 to help prioritize remediation.

Topics

Vulnerability Management Scap Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →