CS0-003 Vulnerability Management — 30 Questions

Question 1

A security analyst is reviewing vulnerability scan results and notices that a critical vulnerability on a web server has a CVSS v3.1 base score of 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which component of the CVSS vector indicates that the vulnerability can be exploited from a remote network?

Accepted Answer

AV:N. AV stands for Attack Vector. AV:N means the vulnerability is exploitable over a network, indicating remote exploitation.

Answer

PR:N

Answer

AC:L

Answer

UI:N

Question 2

A security analyst is using the EPSS to prioritize vulnerabilities for remediation. EPSS is designed to estimate the likelihood that a vulnerability will be exploited in the wild. Which of the following best describes how EPSS should be used in vulnerability management?

Accepted Answer

EPSS should be used as one of several factors in a risk-based prioritization approach.. EPSS provides a probability score (0-1) that a vulnerability will be exploited in the wild within 30 days. It should be used alongside other factors like asset criticality and business context for prioritization.

Answer

EPSS is only relevant for high-severity vulnerabilities with a CVSS score above 9.0.

Answer

EPSS replaces the need for vulnerability scanning because it predicts exploitability.

Answer

EPSS alone should determine the remediation order, ignoring asset criticality.

Question 3

During a vulnerability assessment, a security analyst runs a scan using OpenVAS and reviews the results. One finding indicates a plugin with ID 12345 that detects a missing patch for CVE-2023-1234 on a Linux server. The server is a critical domain controller. Which step of the vulnerability lifecycle is the analyst currently performing?

Accepted Answer

Discovery. The analyst is identifying vulnerabilities via scanning, which is the discovery phase. Prioritization, remediation, and verification come later.

Answer

Remediation

Answer

Prioritization

Answer

Verification

Question 4

A security team is implementing configuration management for a set of Linux servers in a non-DoD environment. They want to apply a security baseline that provides a balanced approach between security and operational efficiency. Which of the following would be most appropriate?

Accepted Answer

CIS Level 1 Benchmark. CIS Benchmarks offer two levels: Level 1 is intended for environments where usability is still a priority, and Level 2 is for high-security environments. For a non-DoD environment, CIS Level 1 is appropriate.

Answer

OWASP Top 10

Answer

CIS Level 2 Benchmark

Answer

STIG for Linux

Question 5

An organization uses a DAST tool to scan a web application. The scanner reports a finding where user input is reflected in the HTTP response without proper encoding. Which OWASP Top 10 category best describes this vulnerability?

Accepted Answer

Cross-Site Scripting (XSS). Reflected XSS occurs when user input is reflected in the response without proper sanitization, leading to script execution. This falls under injection or XSS, but specifically Cross-Site Scripting (XSS) is in the OWASP Top 10 as a type of injection.

Answer

Injection

Answer

Broken Access Control

Answer

Security Misconfiguration

Question 6

A security analyst is using Burp Suite to test an API endpoint. The analyst notices that the API returns detailed error messages when invalid input is provided, revealing database schema information. Which OWASP Top 10 category does this issue primarily relate to?

Accepted Answer

Security Misconfiguration. Detailed error messages revealing internal details are a form of security misconfiguration. The OWASP Top 10 category 'Security Misconfiguration' includes verbose error messages that leak information.

Answer

Injection

Answer

Broken Access Control

Answer

Cryptographic Failures

Question 7

A security team is scanning container images with Trivy and finds a vulnerability with CVSS v3.1 vector AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability exists in a container running as a privileged container on a Kubernetes cluster. The team is prioritizing based on risk. Given the CVSS vector, which factor most significantly reduces the likelihood of exploitation in this context?

Accepted Answer

Attack Vector: Local. AV:L (Local) means the attacker must have local access to exploit. AC:H (High) and PR:H (High) are also limiting, but the attack vector being local means remote exploitation is not possible, which is a strong limiting factor. However, the question asks 'most significantly reduces the likelihood'. While local access is limiting, Attack Complexity High also reduces likelihood. But AV:L is more significant because it restricts the attack source. In the context of a container, local access might be more achievable, but still the vector shows it's not remotely exploitable. The best answer is Attack Vector: Local.

Answer

Privileges Required: High

Answer

Attack Complexity: High

Answer

User Interaction: None

Question 8

During a configuration compliance scan using OpenSCAP, a security analyst finds that several Windows servers have the 'Network access: Do not allow anonymous enumeration of SAM accounts' setting set to 'Disabled'. This finding corresponds to a CIS Benchmark recommendation. Which of the following describes the most appropriate remediation step for this finding?

Accepted Answer

Enable the policy 'Network access: Do not allow anonymous enumeration of SAM accounts' via Group Policy.. The setting should be enabled to prevent anonymous enumeration of SAM accounts. The remediation is to change the policy setting via Group Policy or local security policy.

Answer

Disable the Guest account on all servers.

Answer

Apply a registry key to disable anonymous enumeration.

Answer

Restrict anonymous access using IPsec rules.

Question 9

A security analyst needs to verify that a critical patch was successfully applied to all endpoints in the organization after an emergency patch deployment. Which phase of the vulnerability lifecycle is the analyst performing?

Accepted Answer

Verification. Verification ensures that remediation (patch application) was effective. It occurs after the fix is applied.

Answer

Remediation

Answer

Prioritization

Answer

Discovery

Question 10

A company uses Qualys to scan their internal network. The scan report shows a vulnerability with plugin output indicating that the server is running a version of Apache httpd vulnerable to CVE-2023-1234. The asset is a development web server that is not exposed to the internet. The CVSS score is 7.5 (High). However, the EPSS score is 0.001 (very low). Which of the following should be the primary factor in prioritizing this vulnerability?

Accepted Answer

The asset is a development server not exposed to the internet, so remediation should be scheduled during normal maintenance.. Since the EPSS score is very low, the likelihood of exploitation in the wild is minimal. Additionally, the asset is not internet-facing, reducing exposure. The best approach is to consider the business context and asset criticality; development servers may be lower priority. However, among the options, the EPSS score is a strong indicator of exploitability. But given the low EPSS, the vulnerability might be deprioritized. The question asks for primary factor; business context (asset criticality and exposure) is key. But options include both EPSS and business context. The answer should be business context because the asset is internal and EPSS low, but business context might still prioritize if critical. However, in this scenario, the development server is likely not critical. The most appropriate is to consider the business context including asset criticality and exposure.

Answer

The CVSS score of 7.5 indicates high severity, so it should be remediated immediately.

Answer

The EPSS score of 0.001 indicates very low exploitability, so remediation can be delayed.

Answer

The vulnerability is in Apache httpd, which is widely used, so it must be patched within 24 hours.

Question 11

A security analyst is using Nessus to scan a network. The scan completes and reports a vulnerability with a CVSS v3.1 base score of 5.3 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is a low-information disclosure issue that reveals the server's internal IP address in HTTP headers. The asset is a public-facing web server. Which of the following best describes the risk level and appropriate response?

Accepted Answer

Medium risk; schedule a configuration change to remove the header during the next maintenance window.. The CVSS score is 5.3 (Medium) with low impact on confidentiality and no impact on integrity or availability. Although it is a public-facing server, the risk is low because the information disclosed is minimal (internal IP), which may already be known or easily guessable. The appropriate response is to schedule remediation during normal maintenance, not an emergency.

Answer

Low risk; no action needed because internal IP disclosure is not a vulnerability.

Answer

Critical risk because the server is public-facing; immediate patching is required.

Answer

High risk due to public exposure; apply an emergency patch to hide the header.

Question 12

A security analyst is reviewing a vulnerability scan report from Rapid7 InsightVM. The report shows that a Tomcat server has a plugin finding indicating that the 'Server' header is set to 'Apache-Coyote/1.1', which reveals the server version. Which type of vulnerability does this represent?

Accepted Answer

Security misconfiguration. Revealing server version information is a form of information disclosure, which is a security misconfiguration. It is not an injection, broken access control, or cryptographic failure.

Answer

Broken access control

Answer

Injection vulnerability

Answer

Cryptographic failure

Question 13

A security analyst is prioritizing vulnerabilities for a critical internet-facing application server. The analyst has CVSS scores, EPSS scores, and access to the CISA KEV catalog. Which TWO factors should the analyst consider as the most important for determining remediation priority? (Select TWO)

Accepted Answer

Asset criticality and business context. Asset criticality and business context are crucial because the server is critical and internet-facing. KEV indicates known exploitation, which is also important. However, the question asks for two. The best two are asset criticality (since it's critical) and known exploitation (KEV). CVSS alone doesn't account for exploitability context.

Answer

CVSS base score

Answer

Number of plugins detecting the vulnerability

Answer

EPSS score

Question 14

A security team is implementing container security scanning in their CI/CD pipeline. They want to scan container images for vulnerabilities and Kubernetes misconfigurations. Which THREE tools from the following list are best suited for this purpose? (Select THREE)

Accepted Answer

Trivy. Trivy, Clair, and Snyk are all container image scanning tools. OpenSCAP is for compliance scanning of hosts, not containers. Burp Suite is a web application DAST tool.

Answer

Burp Suite

Answer

OpenSCAP

Question 15

A security analyst is configuring a compliance scanner to check Linux servers against the CIS Benchmark. The analyst wants to ensure that only foundational security configurations are enforced to avoid breaking production applications. Which TWO CIS Benchmark levels would be most appropriate for this environment? (Select TWO)

Accepted Answer

CIS Level 1 Benchmark. CIS Benchmarks define two levels: Level 1 (basic) and Level 2 (comprehensive).

Answer

CIS Level 3 Benchmark

Answer

CIS Level 0 Benchmark

Question 16

A security analyst is reviewing a vulnerability scan report and notices a plugin that identifies a critical vulnerability with a CVSS v3.1 base score of 9.8. The CVSS vector string is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which attack vector is indicated?

Accepted Answer

Network. AV:N indicates network attack vector, meaning the vulnerability can be exploited remotely over the network without any physical or local access.

Answer

Adjacent network

Answer

Local

Answer

Physical

Question 17

A vulnerability management team is prioritizing remediation of several vulnerabilities. They have access to EPSS scores and the CISA KEV catalog. Which factor should they consider FIRST when deciding which vulnerability to remediate?

Accepted Answer

The vulnerability listed in the CISA Known Exploited Vulnerabilities catalog. The CISA KEV catalog contains vulnerabilities that are actively exploited in the wild. These pose immediate risk and should be addressed before others, regardless of EPSS score or other factors.

Answer

The vulnerability with the highest base CVSS score

Answer

The vulnerability affecting the most critical asset

Answer

The vulnerability with the highest EPSS score

Question 18

A cybersecurity analyst is configuring a vulnerability scanning policy for a mixed environment of Linux servers and Windows workstations. The analyst wants to minimize disruption to production services while ensuring comprehensive coverage. Which approach is BEST?

Accepted Answer

Use separate scan windows for Linux servers and Windows workstations with appropriate credentials and performance tuning. Using separate scan windows and credentials for each OS type minimizes disruption by scanning similar systems together and reduces load, while tailored credential profiles improve scan accuracy.

Answer

Deploy agents on all systems to perform continuous scanning

Answer

Scan all systems simultaneously with minimal plugin set to avoid performance issues

Answer

Schedule a single scan of all systems using default credentials and aggressive plugin settings

Question 19

A security analyst is reviewing a DAST scan report for a web application. The report indicates a vulnerability where the application fails to properly validate user-supplied data before using it in a database query. This is most likely which type of vulnerability?

Accepted Answer

Injection. Failure to validate user input before using in a database query is classic SQL injection (injection flaw).

Answer

Cross-site scripting (XSS)

Answer

Security misconfiguration

Answer

Broken access control

Question 20

Which tool is specifically designed to check Linux systems for compliance with security best practices and can be used for configuration auditing?

Accepted Answer

Lynis. Lynis is a security auditing tool for Linux/Unix systems that performs compliance checks and configuration reviews.

Answer

Burp Suite

Answer

OpenVAS

Answer

Nessus