The Privileges Required (PR) metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability. So, this is not the answer we are looking for.The Attack Complexity (AC) metric describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability. So, this is the correct answer. The User Interaction (UI) metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component. That is not what we are looking for here. The Attack Vector (AV) metric describes the context by which vulnerability exploitation is possible. So, that is not the correct answer here either.