CS0-003 Vulnerability Management — 30 Questions

Question 1

During a vulnerability assessment, a security analyst runs a scan using OpenVAS and reviews the results. One finding indicates a plugin with ID 12345 that detects a missing patch for CVE-2023-1234 on a Linux server. The server is a critical domain controller. Which step of the vulnerability lifecycle is the analyst currently performing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Prioritization. The scenario states that the analyst is reviewing the scan results and notes that the affected system is a 'critical domain controller'. Factoring in asset criticality and business impact to determine how to handle a vulnerability is the definition of the Prioritization (or Analysis) phase of the vulnerability management lifecycle. Discovery simply involves running the scan to identify the vulnerabilities, without context-based evaluation.

Answer

Remediation

Answer

Discovery

Answer

Verification

Question 2

An organization uses a DAST tool to scan a web application. The scanner reports a finding where user input is reflected in the HTTP response without proper encoding. Which OWASP Top 10 category best describes this vulnerability?

Accepted Answer

Injection. Reflected XSS occurs when user input is reflected in the response without proper encoding. In the OWASP Top 10 (2021), Cross-Site Scripting is included under the Injection category (A03:2021-Injection) rather than being a separate top-level category. Therefore, the best OWASP Top 10 category for this finding is Injection.

Answer

Cross-Site Scripting (XSS)

Answer

Broken Access Control

Answer

Security Misconfiguration

Question 3

A security analyst is configuring a compliance scanner to check Linux servers against the CIS Benchmark. The analyst wants to ensure that only foundational security configurations are enforced to avoid breaking production applications. Which TWO CIS Benchmark levels would be most appropriate for this environment? (Select TWO)

Accepted Answer

CIS Level 1 Benchmark. CIS Benchmarks define two levels: Level 1 (basic) and Level 2 (comprehensive).

Answer

CIS Level 3 Benchmark

Answer

CIS Level 0 Benchmark

Question 4

A security analyst is reviewing the output of a vulnerability scanner that uses CVSS v3.1. The analyst wants to understand the impact metrics. Which THREE of the following are impact metrics in the CVSS v3.1 base score? (Select THREE.)

Accepted Answer

Confidentiality (C). In CVSS v3.1, the Impact metrics of the base score group are Confidentiality (C), Integrity (I), and Availability (A), so options C, D, and E are correct: Confidentiality (C) measures the loss of confidentiality of information, Integrity (I) measures the loss of integrity of data, and Availability (A) measures the loss of availability of the affected component. These three metrics are collectively known as the CIA triad and directly quantify the impact of a successfully exploited vulnerability. Option A (Scope, S) is incorrect because Scope is part of the Exploitability/Scope metrics, not the Impact metrics, and it indicates whether the vulnerability can affect resources beyond the security scope of the vulnerable component. Option B (Attack Vector, AV) is incorrect because it is an Exploitability metric describing how the vulnerability is exploited (Network, Adjacent, Local, Physical), not an impact metric.

Answer

Scope (S)

Answer

Attack Vector (AV)

Question 5

A security analyst is reviewing a DAST scan result for a web application. The scanner reports a finding that allows an attacker to redirect users to a malicious site via a parameter in the URL. Which OWASP Top 10 category does this finding most likely belong to?

Accepted Answer

A05:2021 – Security Misconfiguration. Open redirect vulnerabilities are classified under Security Misconfiguration or sometimes under A03:2021 – Injection? Actually OWASP Top 10 2021 includes 'Security Misconfiguration' (A05). Open redirect is typically a security misconfiguration. However, more precisely, it's often considered under 'Broken Access Control'? No, open redirect is not access control. The closest is Security Misconfiguration because it involves improper handling of redirect parameters.

Answer

A08:2021 – Software and Data Integrity Failures

Answer

A03:2021 – Injection

Answer

A01:2021 – Broken Access Control

Question 6

A security analyst is using Burp Suite to test a web application for vulnerabilities. Which TWO of the following are common web application vulnerabilities that can be detected using Burp Suite? (Select TWO)

Accepted Answer

Cross-site scripting (XSS). Cross-site scripting (XSS) (C) is correct because Burp Suite's Scanner and Repeater can inject payloads into HTTP parameters, headers, and cookies and analyze reflected or stored responses to confirm XSS in web application input handling. SQL injection (E) is correct because Burp Suite detects it by manipulating parameters with SQL metacharacters and payloads and observing database error messages, boolean-based differences, or time delays via its Scanner and Intruder tools. Buffer overflow (A) is not typically detectable by Burp Suite, since it is a memory-corruption flaw in native code that requires binary analysis or fuzzing tools rather than HTTP-level web testing. Race condition (D) is not a standard Burp Suite detection target, as it depends on concurrent request timing and is usually identified with specialized concurrency testing rather than Burp's request manipulation features. Insecure deserialization (B) is a web-relevant vulnerability, but it is not one of the two marked correct answers here and is not reliably detected by Burp Suite's standard scanning capabilities.

Answer

Buffer overflow

Answer

Insecure deserialization

Answer

Race condition

Question 7

A security analyst is conducting a vulnerability assessment on a cloud environment and needs to select a tool to scan for misconfigurations against the CIS AWS Foundations Benchmark. Which TWO of the following tools are capable of performing compliance scanning against cloud benchmarks? (Select TWO.)

Accepted Answer

OpenSCAP. OpenSCAP and cloud-specific tools like ScoutSuite (or Prowler) can assess cloud configurations against CIS benchmarks. Nessus and Qualys primarily do vulnerability scanning, though they may have some compliance modules, but the question expects tools specifically for cloud benchmarks. OpenSCAP can be used with cloud content, and ScoutSuite is a cloud security auditing tool.

Answer

Nessus

Answer

Qualys

Answer

Wireshark

Question 8

A security analyst is reviewing the results of a web application vulnerability scan and needs to identify the vulnerabilities that are part of the OWASP Top 10 (2021) category 'Injection'. Which THREE of the following vulnerabilities fall under this category? (Select THREE.)

Accepted Answer

SQL injection. SQL injection (A) is correct because it is the canonical injection flaw in the OWASP Top 10 2021 A03:2021-Injection category, where untrusted input is interpreted as SQL code by the database. OS command injection (B) is correct because it also falls under A03:2021-Injection, as attacker-supplied data is passed to a shell and executed as operating system commands. Cross-Site Scripting (C) is correct because OWASP explicitly folds XSS into A03:2021-Injection, since browser-interpreted script is injected into a trusted page. Broken Access Control (C) is not part of Injection; it is its own category, A01:2021-Broken Access Control. Security Misconfiguration (E) is also separate, listed as A05:2021-Security Misconfiguration, and does not describe injection of untrusted data into an interpreter.

Answer

Broken Access Control

Answer

Security Misconfiguration

Question 9

A vulnerability scan identifies a plugin output for 'SMB Signing Disabled' on a Windows server. The CVSS v3.1 base score is 5.3 (Medium). The asset is a file server used only internally. The organization has decided not to enable SMB signing due to performance concerns. Which of the following is the BEST compensating control?

Accepted Answer

Segment the file server into a separate VLAN with strict access controls. SMB signing prevents man-in-the-middle and relay attacks by cryptographically signing SMB packets. If the organization refuses to enable it for performance reasons, the best compensating control is to reduce the attack surface by isolating the file server in a segmented VLAN with strict access controls, so only trusted hosts can reach SMB. This limits the exposure that signing would otherwise mitigate.

Answer

Upgrade to SMB version 3.0 which has built-in signing

Answer

Accept the risk and document the decision

Answer

Apply a host-based firewall rule to block SMB traffic from all sources

Question 10

A security analyst is performing a cloud security assessment for an AWS environment. Which THREE of the following configurations would be considered CIS AWS Foundations Benchmark violations?

Accepted Answer

Password policy does not require any complexity (lowercase only). The CIS AWS Foundations Benchmark requires IAM password policies to have a minimum length of 14 characters and to require at least one uppercase letter, one lowercase letter, one number, and one symbol. Option B only specifies a minimum length of 8 and at least one uppercase letter, which fails multiple CIS requirements and is therefore a violation. Options A, C, and D are also violations as identified. Thus, the correct options are A, B, C, and D, making the question's 'THREE' incorrect.

Answer

Root account has MFA enabled

Question 11

During a vulnerability assessment, a security analyst uses Nessus to scan a network. Which type of scan is most appropriate to identify live hosts and open ports without causing significant disruption?

Accepted Answer

TCP SYN scan. A TCP SYN scan is the most appropriate because it is a half-open scan that does not complete the TCP handshake, making it stealthy and less disruptive. It efficiently identifies live hosts and open ports without establishing full connections.

Answer

Full connect scan

Answer

UDP scan

Answer

Ping sweep

Question 12

A security analyst is performing an API vulnerability test. Which THREE of the following are common API vulnerabilities according to OWASP? (Select THREE.)

Accepted Answer

SQL injection in the API endpoint. OWASP API Security Top 10 includes injection (including SQL injection), broken object level authorization, excessive data exposure, and mass assignment. The original explanation omits injection, making the marked answer set incomplete and the question ambiguous.

Answer

Cross-Site Request Forgery (CSRF)

Question 13

A cloud security team is using a container image scanning tool and finds a vulnerability in a base image used by many containers. The vulnerability is rated CVSS 7.5 and has a high EPSS score. However, rebuilding all containers with a patched base image will take significant time. What is the best immediate action?

Accepted Answer

Increase network segmentation to limit exposure from the vulnerability.. High EPSS indicates active exploitation is likely, so immediate containment is needed. Since rebuilding images will take time, the best immediate action is to apply compensating controls such as network segmentation to limit exposure. Patching packages inside running containers is an anti-pattern in immutable container environments: changes are lost on restart and create configuration drift.

Answer

Wait for the next scheduled rebuild cycle to patch the base image.

Answer

Apply a hotfix or workaround to the affected package in running containers.

Answer

Remove all containers using the vulnerable base image immediately.

Question 14

A cybersecurity analyst is reviewing the configuration of a Linux server against CIS Benchmarks. The analyst notices that several settings deviate from the recommended baseline. Which TWO of the following are most likely to be considered Level 1 CIS Benchmark recommendations?

Accepted Answer

Set password expiration to 90 days. Option C is correct because CIS Benchmarks place password expiration limits (commonly 90 days or fewer, e.g., PASS_MAX_DAYS 90 in /etc/login.defs) among Level 1 recommendations, since they are basic, low-impact hardening steps applicable to virtually all systems. Option D is correct because disabling direct SSH root login (PermitRootLogin no in /etc/ssh/sshd_config) is a foundational Level 1 control that reduces attack surface without disrupting normal operations. Option A is not a specific CIS Level 1 recommendation but a general hardening principle, and it is too broad to be a discrete benchmark item. Option B is typically a higher-impact or profile-dependent control (often Level 2 or requiring careful tuning) because enforcing SELinux can break applications. Option E is generally considered a more advanced or Level 2 control, as detailed audit rule configuration requires tailoring to the environment.

Answer

Remove all unnecessary packages and services

Answer

Enable mandatory access control (SELinux) in enforcing mode

Answer

Configure audit rules for file permission changes

Question 15

A security analyst is reviewing a compliance scan report for a DoD environment that uses Security Technical Implementation Guides (STIGs). The report indicates several failures. Which TWO of the following are likely STIG requirements for a Windows 10 system?

Accepted Answer

Enable Windows Defender Credential Guard. STIGs for Windows 10 require hardening measures such as enabling Windows Defender Credential Guard to help protect credentials from credential-theft attacks, and setting a minimum password length of at least 14 characters. Insecure settings—automatic logon with blank password, disabling audit logs, and enabling SMBv1—would violate STIG requirements.

Answer

Allow automatic logon with empty password

Answer

Disable audit log generation for failed logins

Answer

Enable SMBv1 protocol for compatibility

Question 16

A security analyst is prioritizing vulnerabilities for remediation. The analyst has identified several vulnerabilities with CVSS scores, but wants to incorporate additional context to ensure the most critical vulnerabilities are addressed first. Which TWO factors should the analyst consider beyond the CVSS base score? (Choose two.)

Accepted Answer

Exploit Prediction Scoring System (EPSS). EPSS provides a probability of exploitation based on real-world data, and KEV is a catalog of known exploited vulnerabilities from CISA. Both give additional context beyond CVSS. While the number of affected assets and vendor patch availability are also useful, EPSS and KEV specifically indicate real-world exploitation likelihood and are commonly used together for vulnerability prioritization.

Answer

Number of affected assets

Answer

Vulnerability publication date

Answer

Vendor patch availability

Question 17

A security team is conducting a vulnerability assessment on a web application that uses a SQL database backend. During a manual test, the tester enters a single quote in the username field and receives a database error message that includes the SQL query and database version. The tester wants to confirm whether this is a true SQL injection vulnerability and then exploit it to extract data. Which of the following actions should the tester take NEXT to confirm and exploit the vulnerability?

Accepted Answer

Perform a UNION SELECT injection to retrieve the database version and confirm the vulnerability.. The observed database error indicates a potential SQL injection vulnerability. To confirm it, the tester should attempt a UNION SELECT injection to retrieve database information, which directly demonstrates exploitability and can extract data. Automated tools or blind techniques are better suited for later stages or when error messages are suppressed. Manual confirmation via UNION SELECT is the logical next step.

Answer

Inject a payload such as ' OR '1'='1 to test for authentication bypass and confirm the vulnerability.

Answer

Use a time-based blind SQL injection payload to cause a delay, confirming the vulnerability without relying on error messages.

Answer

Use sqlmap with the --batch option to automatically detect and exploit the SQL injection.

Question 18

A security analyst is reviewing a vulnerability scan report from a credentialed scan of a Windows Server 2019 host. The report shows a critical vulnerability in a Microsoft library, but the analyst knows the host has the latest cumulative updates installed. The analyst runs an unauthenticated scan and the vulnerability does not appear. Which of the following best explains this discrepancy?

Accepted Answer

The credentialed scan used outdated plugins that incorrectly flagged a patched library.. The credentialed scan produced a false positive likely because the vulnerability scanner's plugins were outdated, leading to incorrect detection of a patched library. Since the host has the latest cumulative updates, the vulnerability should not be present. Updating the scanner plugins and rescanning would resolve the discrepancy. Unauthenticated scans cannot inspect local file versions, so they would not detect this false positive.

Answer

The credentialed scan detected a vulnerability in a different library that shares the same CVE identifier.

Answer

The unauthenticated scan cannot see the vulnerability because it lacks credentials to perform local checks.

Answer

The vulnerability is a false positive in the unauthenticated scan due to network-based detection limitations.

Question 19

A security analyst is configuring a vulnerability scan of a web application. The analyst wants to identify vulnerabilities such as SQL injection and cross-site scripting. The scan must not modify any data in the application. Which of the following scan types should the analyst use?

Accepted Answer

Non-intrusive scan. A non-intrusive scan is designed to analyze application responses without sending harmful payloads, making it safe for production environments where data modification is prohibited. It can detect vulnerabilities like SQL injection and XSS by examining how the application handles input and output. Intrusive scans may alter data, and authenticated or unauthenticated scans do not guarantee non-intrusiveness. Thus, the non-intrusive scan is the correct choice.

Answer

Authenticated scan

Answer

Intrusive scan

Answer

Unauthenticated scan

Question 20

A security analyst is reviewing a vulnerability scan report and needs to prioritize remediation. The analyst has access to CVSS v3.1 base scores, EPSS scores, and asset criticality ratings. Which of the following factors should the analyst consider to effectively prioritize the vulnerabilities? (Choose two.)

Accepted Answer

EPSS score. To prioritize vulnerabilities effectively, the analyst should combine severity (CVSS) with exploit likelihood (EPSS). CVSS provides a standardized severity score, while EPSS estimates the probability of exploitation. Together, they help identify vulnerabilities that are both severe and likely to be exploited. Asset criticality also matters but is not one of the two factors asked. The number of open ports and patch release date are less directly relevant to prioritization.

Answer

Vendor patch release date

Answer

Asset criticality rating

Answer

Number of open ports on the asset