All is correct about CVSS $,$ except $\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_.$

a$.$

Prevent the capability of an attacker to execute an attack against it$.$

b$.$

CVSS does not measure severity but risk.

c$.$

imperfect way to manage risk.

d$.$

cannot indicate when or if an attacker willattempt to exploit the vulnerability.