CS0-003 Vulnerability Management Practice Test 2 — 15 Questions

Question 1

A security analyst is prioritizing vulnerabilities for remediation. The analyst has identified several vulnerabilities with CVSS scores, but wants to incorporate additional context to ensure the most critical vulnerabilities are addressed first. Which TWO factors should the analyst consider beyond the CVSS base score? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Exploit Prediction Scoring System (EPSS). EPSS provides a probability of exploitation based on real-world data, and KEV is a catalog of known exploited vulnerabilities from CISA. Both give additional context beyond CVSS. While the number of affected assets and vendor patch availability are also useful, EPSS and KEV specifically indicate real-world exploitation likelihood and are commonly used together for vulnerability prioritization.

Answer

Number of affected assets

Answer

Vulnerability publication date

Answer

Vendor patch availability

Question 2

A security team is conducting a vulnerability assessment on a web application that uses a SQL database backend. During a manual test, the tester enters a single quote in the username field and receives a database error message that includes the SQL query and database version. The tester wants to confirm whether this is a true SQL injection vulnerability and then exploit it to extract data. Which of the following actions should the tester take NEXT to confirm and exploit the vulnerability?

Accepted Answer

Perform a UNION SELECT injection to retrieve the database version and confirm the vulnerability.. The observed database error indicates a potential SQL injection vulnerability. To confirm it, the tester should attempt a UNION SELECT injection to retrieve database information, which directly demonstrates exploitability and can extract data. Automated tools or blind techniques are better suited for later stages or when error messages are suppressed. Manual confirmation via UNION SELECT is the logical next step.

Answer

Inject a payload such as ' OR '1'='1 to test for authentication bypass and confirm the vulnerability.

Answer

Use a time-based blind SQL injection payload to cause a delay, confirming the vulnerability without relying on error messages.

Answer

Use sqlmap with the --batch option to automatically detect and exploit the SQL injection.

Question 3

A security analyst is reviewing a vulnerability scan report from a credentialed scan of a Windows Server 2019 host. The report shows a critical vulnerability in a Microsoft library, but the analyst knows the host has the latest cumulative updates installed. The analyst runs an unauthenticated scan and the vulnerability does not appear. Which of the following best explains this discrepancy?

Accepted Answer

The credentialed scan used outdated plugins that incorrectly flagged a patched library.. The credentialed scan produced a false positive likely because the vulnerability scanner's plugins were outdated, leading to incorrect detection of a patched library. Since the host has the latest cumulative updates, the vulnerability should not be present. Updating the scanner plugins and rescanning would resolve the discrepancy. Unauthenticated scans cannot inspect local file versions, so they would not detect this false positive.

Answer

The credentialed scan detected a vulnerability in a different library that shares the same CVE identifier.

Answer

The unauthenticated scan cannot see the vulnerability because it lacks credentials to perform local checks.

Answer

The vulnerability is a false positive in the unauthenticated scan due to network-based detection limitations.

Question 4

A security analyst is configuring a vulnerability scan of a web application. The analyst wants to identify vulnerabilities such as SQL injection and cross-site scripting. The scan must not modify any data in the application. Which of the following scan types should the analyst use?

Accepted Answer

Non-intrusive scan. A non-intrusive scan is designed to analyze application responses without sending harmful payloads, making it safe for production environments where data modification is prohibited. It can detect vulnerabilities like SQL injection and XSS by examining how the application handles input and output. Intrusive scans may alter data, and authenticated or unauthenticated scans do not guarantee non-intrusiveness. Thus, the non-intrusive scan is the correct choice.

Answer

Authenticated scan

Answer

Intrusive scan

Answer

Unauthenticated scan

Question 5

A security analyst is reviewing a vulnerability scan report and needs to prioritize remediation. The analyst has access to CVSS v3.1 base scores, EPSS scores, and asset criticality ratings. Which of the following factors should the analyst consider to effectively prioritize the vulnerabilities? (Choose two.)

Accepted Answer

EPSS score. To prioritize vulnerabilities effectively, the analyst should combine severity (CVSS) with exploit likelihood (EPSS). CVSS provides a standardized severity score, while EPSS estimates the probability of exploitation. Together, they help identify vulnerabilities that are both severe and likely to be exploited. Asset criticality also matters but is not one of the two factors asked. The number of open ports and patch release date are less directly relevant to prioritization.

Answer

Vendor patch release date

Answer

Asset criticality rating

Answer

Number of open ports on the asset

Question 6

A security analyst is reviewing a vulnerability scan report and sees a finding with a CVSS v3.1 base score of 10.0. The analyst wants to understand the meaning of this score. Which of the following best describes a CVSS v3.1 base score of 10.0?

Accepted Answer

The vulnerability is critical and easy to exploit with high impact.. A CVSS v3.1 base score of 10.0 represents the highest severity, indicating a vulnerability that is typically network exploitable, requires no authentication or user interaction, and has high impact on confidentiality, integrity, and availability. It does not convey exploit likelihood or remediation difficulty. The analyst should prioritize such vulnerabilities for immediate action, but also consider threat intelligence and asset criticality.

Answer

The vulnerability is low risk but has a high likelihood of exploitation.

Answer

The vulnerability requires local access and user interaction to exploit.

Answer

The vulnerability has no known exploits and is difficult to remediate.

Question 7

A security analyst is reviewing vulnerability scan results and notices that a critical vulnerability on a web server has a CVSS v3.1 base score of 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which component of the CVSS vector indicates that the vulnerability can be exploited from a remote network?

Accepted Answer

AV:N. AV stands for Attack Vector. AV:N means the vulnerability is exploitable over a network, indicating remote exploitation.

Answer

PR:N

Answer

AC:L

Answer

UI:N

Question 8

A security analyst is using the EPSS to prioritize vulnerabilities for remediation. EPSS is designed to estimate the likelihood that a vulnerability will be exploited in the wild. Which of the following best describes how EPSS should be used in vulnerability management?

Accepted Answer

EPSS should be used as one of several factors in a risk-based prioritization approach.. EPSS provides a probability score (0-1) that a vulnerability will be exploited in the wild within 30 days. It should be used alongside other factors like asset criticality and business context for prioritization.

Answer

EPSS is only relevant for high-severity vulnerabilities with a CVSS score above 9.0.

Answer

EPSS replaces the need for vulnerability scanning because it predicts exploitability.

Answer

EPSS alone should determine the remediation order, ignoring asset criticality.

Question 9

A security team is implementing configuration management for a set of Linux servers in a non-DoD environment. They want to apply a security baseline that provides a balanced approach between security and operational efficiency. Which of the following would be most appropriate?

Accepted Answer

CIS Level 1 Benchmark. CIS Benchmarks offer two levels: Level 1 is intended for environments where usability is still a priority, and Level 2 is for high-security environments. For a non-DoD environment, CIS Level 1 is appropriate.

Answer

OWASP Top 10

Answer

CIS Level 2 Benchmark

Answer

STIG for Linux

Question 10

A security analyst is using Burp Suite to test an API endpoint. The analyst notices that the API returns detailed error messages when invalid input is provided, revealing database schema information. Which OWASP Top 10 category does this issue primarily relate to?

Accepted Answer

Security Misconfiguration. Detailed error messages revealing internal details are a form of security misconfiguration. The OWASP Top 10 category 'Security Misconfiguration' includes verbose error messages that leak information.

Answer

Injection

Answer

Broken Access Control

Answer

Cryptographic Failures

Question 11

A security team is scanning container images with Trivy and finds a vulnerability with CVSS v3.1 vector AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability exists in a container running as a privileged container on a Kubernetes cluster. The team is prioritizing based on risk. Given the CVSS vector, which factor most significantly reduces the likelihood of exploitation in this context?

Accepted Answer

Attack Vector: Local. AV:L (Local) means the attacker must have local access to exploit. AC:H (High) and PR:H (High) are also limiting, but the attack vector being local means remote exploitation is not possible, which is a strong limiting factor. However, the question asks 'most significantly reduces the likelihood'. While local access is limiting, Attack Complexity High also reduces likelihood. But AV:L is more significant because it restricts the attack source. In the context of a container, local access might be more achievable, but still the vector shows it's not remotely exploitable. The best answer is Attack Vector: Local.

Answer

Privileges Required: High

Answer

Attack Complexity: High

Answer

User Interaction: None

Question 12

During a configuration compliance scan using OpenSCAP, a security analyst finds that several Windows servers have the 'Network access: Do not allow anonymous enumeration of SAM accounts' setting set to 'Disabled'. This finding corresponds to a CIS Benchmark recommendation. Which of the following describes the most appropriate remediation step for this finding?

Accepted Answer

Enable the policy 'Network access: Do not allow anonymous enumeration of SAM accounts' via Group Policy.. The setting should be enabled to prevent anonymous enumeration of SAM accounts. The remediation is to change the policy setting via Group Policy or local security policy.

Answer

Disable the Guest account on all servers.

Answer

Apply a registry key to disable anonymous enumeration.

Answer

Restrict anonymous access using IPsec rules.

Question 13

A security analyst needs to verify that a critical patch was successfully applied to all endpoints in the organization after an emergency patch deployment. Which phase of the vulnerability lifecycle is the analyst performing?

Accepted Answer

Verification. Verification ensures that remediation (patch application) was effective. It occurs after the fix is applied.

Answer

Remediation

Answer

Prioritization

Answer

Discovery

Question 14

A company uses Qualys to scan their internal network. The scan report shows a vulnerability with plugin output indicating that the server is running a version of Apache httpd vulnerable to CVE-2023-1234. The asset is a development web server that is not exposed to the internet. The CVSS score is 7.5 (High). However, the EPSS score is 0.001 (very low). Which of the following should be the primary factor in prioritizing this vulnerability?

Accepted Answer

The asset is a development server not exposed to the internet, so remediation should be scheduled during normal maintenance.. Since the EPSS score is very low, the likelihood of exploitation in the wild is minimal. Additionally, the asset is not internet-facing, reducing exposure. The best approach is to consider the business context and asset criticality; development servers may be lower priority. However, among the options, the EPSS score is a strong indicator of exploitability. But given the low EPSS, the vulnerability might be deprioritized. The question asks for primary factor; business context (asset criticality and exposure) is key. But options include both EPSS and business context. The answer should be business context because the asset is internal and EPSS low, but business context might still prioritize if critical. However, in this scenario, the development server is likely not critical. The most appropriate is to consider the business context including asset criticality and exposure.

Answer

The CVSS score of 7.5 indicates high severity, so it should be remediated immediately.

Answer

The EPSS score of 0.001 indicates very low exploitability, so remediation can be delayed.

Answer

The vulnerability is in Apache httpd, which is widely used, so it must be patched within 24 hours.

Question 15

A security analyst is using Nessus to scan a network. The scan completes and reports a vulnerability with a CVSS v3.1 base score of 5.3 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is a low-information disclosure issue that reveals the server's internal IP address in HTTP headers. The asset is a public-facing web server. Which of the following best describes the risk level and appropriate response?

Accepted Answer

Medium risk; schedule a configuration change to remove the header during the next maintenance window.. The CVSS score is 5.3 (Medium) with low impact on confidentiality and no impact on integrity or availability. Although it is a public-facing server, the risk is low because the information disclosed is minimal (internal IP), which may already be known or easily guessable. The appropriate response is to schedule remediation during normal maintenance, not an emergency.

Answer

Low risk; no action needed because internal IP disclosure is not a vulnerability.

Answer

Critical risk because the server is public-facing; immediate patching is required.

Answer

High risk due to public exposure; apply an emergency patch to hide the header.