The correct options are Provide a common numeric score to prioritize remediation work and Estimate the likely impact and severity of a vulnerability.

An industry standard scoring framework gives each vulnerability a repeatable numeric value that teams can use to prioritize remediation across many findings. That numeric score supports consistent decision making and resource allocation when there are more issues than the team can immediately fix.

The scoring model also captures attributes that reflect potential impact and severity so analysts can estimate how a vulnerability might affect confidentiality, integrity, or availability. Those impact and severity estimates help set remediation urgency and guide risk-based choices.

Standardize documentation of the entire software development lifecycle is incorrect because scoring frameworks are focused on measuring and communicating vulnerability severity rather than documenting process steps across development.

Maintain an inventory of code bugs and security vulnerabilities is incorrect because the scoring system provides severity ratings but does not itself act as an inventory or tracking database. Teams typically store and track findings in a vulnerability management platform or ticketing system and attach scores to those records.

Full AWS Practitioner Certification Question