CS0-003 Practice Test 36 — 15 Questions

Question 1

A company has a policy to remediate vulnerabilities within 30 days. A critical vulnerability is discovered on a database server. The patch requires a reboot, and the database cannot be taken offline during business hours. Which of the following is the BEST approach?

Accepted Answer

Implement a compensating control. Option A is correct because when a critical vulnerability requires a patch that mandates a reboot, but the database cannot be taken offline during business hours, implementing a compensating control (such as network segmentation, strict firewall rules, or an intrusion prevention system (IPS) signature) reduces the risk to an acceptable level until the patch can be applied. This aligns with the 30-day remediation policy by addressing the vulnerability without violating operational constraints.

Answer

Apply a hotfix without reboot

Answer

Schedule the patch during the next maintenance window

Answer

Extend the remediation deadline

Question 2

A company uses a mix of Windows and Linux servers. The vulnerability scanner reports a critical remote code execution vulnerability in Apache Struts (CVE-2017-5638) on a web server located in the DMZ. This server is behind a load balancer with an identical twin server that does not appear vulnerable. The security team needs to implement immediate remediation while minimizing downtime. What should the analyst do?

Accepted Answer

Implement a virtual patch via web application firewall (WAF) rules. Option B is correct because implementing a virtual patch via WAF rules can immediately block exploitation attempts against CVE-2017-5638 (Apache Struts) without modifying the server or taking it offline. The WAF inspects HTTP requests for malicious Content-Type headers used in the exploit and drops them, providing protection while the identical twin server remains unaffected and the vulnerable server can be patched later with minimal downtime.

Answer

Re-image the server with a hardened operating system

Answer

Shut down the vulnerable server until a patch can be tested

Answer

Apply the vendor patch immediately during business hours

Question 3

Which THREE of the following are common challenges in vulnerability management? (Select THREE)

Accepted Answer

Lack of asset inventory. Option B is correct because without a complete and accurate asset inventory, vulnerability management cannot identify which systems require scanning or patching. An asset inventory provides the foundational data for vulnerability scanning scope, and its absence leads to blind spots where unmanaged systems remain unpatched and vulnerable.

Answer

Inability to scan all systems

Answer

Excessive budget

Question 4

An organization uses automated patch management for workstations but manual patching for servers. After a critical vulnerability is announced, the security team wants to expedite patching for servers. Which of the following is the BEST approach?

Accepted Answer

Test the patch in a staging environment and then deploy. Option A is correct because testing the patch in a staging environment before deploying to production servers validates compatibility and stability, reducing the risk of service disruption. This approach balances the urgency of a critical vulnerability with the need to maintain server availability, which is especially important given that manual patching is the standard procedure for servers. Staging allows the security team to identify any conflicts with existing configurations or dependencies before widespread deployment.

Answer

Disable the affected services until the patch can be applied

Answer

Deploy the patch immediately to all servers

Answer

Implement virtual patching via an IPS

Question 5

During a vulnerability scan, the scanner reports a high number of open ports on a server that is supposed to be a hardened web server. The analyst investigates and finds that the server is running unnecessary services. Which of the following is the MOST effective long-term solution?

Accepted Answer

Implement a configuration management baseline and enforce it. Implementing a configuration management baseline and enforcing it (Option A) is the most effective long-term solution because it ensures that the server is consistently provisioned with only the necessary services and configurations. This approach uses tools like Ansible, Puppet, or Chef to automatically remediate drift, preventing unnecessary services from reappearing after manual changes or reboots. It addresses the root cause by codifying the desired state, rather than relying on ad-hoc fixes.

Answer

Disable the unnecessary services manually

Answer

Increase the frequency of vulnerability scans

Answer

Install a host-based firewall to block the ports

Question 6

A security analyst has identified a critical vulnerability that affects multiple systems. The analyst needs to report the vulnerability to management. Which THREE elements should be included in the vulnerability report? (Choose three.)

Accepted Answer

Number of affected systems and their criticality. Option A is correct because a vulnerability report must convey the scope and business impact of the issue. Including the number of affected systems and their criticality (e.g., system classification, data sensitivity, or role in the network) allows management to prioritize remediation based on risk exposure. Without this context, management cannot assess the urgency or allocate resources effectively.

Answer

Specific patch installation dates for each system

Answer

Organizational risk appetite

Question 7

A security analyst is reviewing a vulnerability scan report and must prioritize remediation efforts. Which TWO factors are most important for prioritizing vulnerability remediation?

Accepted Answer

CVSS base score. The CVSS base score (B) provides a standardized, vendor-neutral severity rating (0-10) that reflects the intrinsic characteristics of a vulnerability, such as attack vector, complexity, and impact on confidentiality, integrity, and availability. This score is a primary factor for prioritization because it allows analysts to compare vulnerabilities across different systems and prioritize those with the highest potential for damage, independent of environmental factors.

Answer

Time since vulnerability published

Answer

Vendor patch release date

Answer

Number of hosts affected

Question 8

An analyst is reviewing scan results and finds that a critical vulnerability is present on 50 workstations. The vendor has released a patch, but the IT team is concerned about potential compatibility issues. Which of the following should the analyst recommend?

Accepted Answer

Test the patch on a subset before full deployment. Option B is correct because the IT team's concern about compatibility issues necessitates a controlled rollout. Testing the patch on a subset of workstations allows the analyst to validate that the patch does not break critical business applications or system functionality before full deployment, aligning with the vulnerability management principle of staged patching to minimize operational risk.

Answer

Remove the vulnerable software

Answer

Apply a workaround from the vendor

Answer

Deploy the patch to all workstations immediately

Question 9

A security analyst discovers a server that is missing multiple critical patches. The server hosts a legacy application that cannot be patched immediately due to compatibility issues. Which of the following is the BEST approach to manage the vulnerability risk?

Accepted Answer

Implement network segmentation and increase monitoring. Option B is the best approach because network segmentation isolates the vulnerable legacy server from critical assets, reducing the attack surface, while increased monitoring allows the security team to detect and respond to any exploitation attempts in real time. This balances risk acceptance with active defense, which is a core principle of vulnerability management when patching is not immediately feasible.

Answer

Apply a virtual patch using a WAF

Answer

Disable the server until a patch is available

Answer

Remove the server from the network

Question 10

A vulnerability scanner reports that an internal web application is vulnerable to SQL injection. The development team says they fixed it by input sanitization. Which of the following should the analyst do FIRST?

Accepted Answer

Rescan the application to confirm remediation. Option C is correct because the first step after a claimed fix is to verify the remediation by rescanning the application with the same vulnerability scanner. This provides objective evidence that the SQL injection vector is no longer exploitable, confirming the input sanitization was effective before any further actions are taken.

Answer

Update the vulnerability report

Answer

Perform a manual penetration test

Answer

Review the code changes

Question 11

A vulnerability management analyst is reviewing the results of an authenticated scan. The analyst identifies several medium-severity vulnerabilities that have been present for over a year. Which of the following are the best actions to take? (Choose two.)

Accepted Answer

Verify the vulnerabilities are still relevant by re-scanning.. Option A is correct because re-scanning verifies whether the vulnerabilities are still present or have been remediated by other means (e.g., patching, configuration changes). Over a year, the environment may have changed, and the original scan results could be stale. An authenticated scan provides deeper visibility, but a fresh scan is the only way to confirm current relevance before taking further action.

Answer

Accept the risk if the system is no longer in use.

Answer

Remove the system from the network.

Answer

Increase the severity rating to high to ensure remediation.

Question 12

An organization performs quarterly vulnerability scans of its internal network. The scans have a high number of false positives for out-of-date software that is actually up to date. Which of the following would BEST improve the accuracy of the scans?

Accepted Answer

Implement credential-based scanning.. Credential-based scanning (authenticated scanning) allows the scanner to log into target systems with valid credentials, enabling it to query the local registry or package manager for the exact installed software versions. This eliminates reliance on banner grabbing or service fingerprinting, which often produce false positives when out-of-date software is detected based on network-level heuristics rather than actual installed patches.

Answer

Disable verbose output to reduce clutter.

Answer

Increase scan frequency to monthly.

Answer

Use a different vulnerability scanner.

Question 13

A company is implementing a vulnerability management program. Which of the following are essential components of a vulnerability management lifecycle? (Choose three.)

Accepted Answer

Vulnerability scanning and assessment.. Vulnerability scanning and assessment is a core component of the vulnerability management lifecycle because it involves actively identifying security weaknesses in systems, applications, and network devices using tools like Nessus or Qualys. This step provides the raw data—CVEs, missing patches, misconfigurations—that drives the entire remediation process. Without regular scanning, the organization cannot maintain an accurate picture of its security posture.

Answer

Penetration testing on all systems.

Answer

Automated patch deployment.

Question 14

Based on the scan output, which vulnerability should be prioritized first for remediation?

Accepted Answer

CVE-2020-15778. CVE-2020-15778 is a critical command injection vulnerability in OpenSSH's scp utility (CVE-2020-15778) that allows an unauthenticated remote attacker to execute arbitrary commands on the target system by crafting a malicious scp source path. This vulnerability has a CVSS score of 8.8 (High) and is remotely exploitable without authentication, making it the highest priority for remediation over the other listed CVEs.

Answer

CVE-2019-16905

Answer

CVE-2020-12060

Answer

Both A and B equally.

Question 15

Your organization has deployed a new web application on a Linux server. The application uses a custom database port (TCP 3307). During a routine vulnerability scan, the scanner reports a critical vulnerability: 'MySQL Server - Unrestricted File Upload (CVE-20XX-XXXX)'. The system administrator confirms that MySQL is not installed; the custom database uses PostgreSQL on port 3307. The scanner likely misidentified the service due to port-based fingerprinting. On further investigation, you find that the scanner's fingerprinting database has an incorrect mapping for port 3307. The PostgreSQL version is current and fully patched. The environment is production and cannot be disrupted. Which of the following is the BEST action to take?

Accepted Answer

Mark the vulnerability as a false positive and suppress it for this asset.. Option D is correct because the vulnerability report is based on a false positive: the scanner misidentified the service on port 3307 as MySQL due to an incorrect port mapping in its fingerprinting database, while the actual service is a fully patched PostgreSQL. Since MySQL is not installed and no actual vulnerability exists, marking the finding as a false positive and suppressing it for this asset is the appropriate response in a production environment that cannot be disrupted.

Answer

Manually update the scanner's database to correct the port mapping.

Answer

Schedule an immediate patch of the supposed MySQL vulnerability.

Answer

Apply a workaround to block file upload functionality on port 3307.