CS0-003 Vulnerability Management Practice Test 2 — 15 Questions

Question 1

A security analyst is reviewing a vulnerability scan report and notices a plugin that identifies a critical vulnerability with a CVSS v3.1 base score of 9.8. The CVSS vector string is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which attack vector is indicated?

Accepted Answer

Network. AV:N indicates network attack vector, meaning the vulnerability can be exploited remotely over the network without any physical or local access.

Answer

Adjacent network

Answer

Local

Answer

Physical

Question 2

A vulnerability management team is prioritizing remediation of several vulnerabilities. They have access to EPSS scores and the CISA KEV catalog. Which factor should they consider FIRST when deciding which vulnerability to remediate?

Accepted Answer

The vulnerability listed in the CISA Known Exploited Vulnerabilities catalog. The CISA KEV catalog contains vulnerabilities that are actively exploited in the wild. These pose immediate risk and should be addressed before others, regardless of EPSS score or other factors.

Answer

The vulnerability with the highest base CVSS score

Answer

The vulnerability affecting the most critical asset

Answer

The vulnerability with the highest EPSS score

Question 3

A cybersecurity analyst is configuring a vulnerability scanning policy for a mixed environment of Linux servers and Windows workstations. The analyst wants to minimize disruption to production services while ensuring comprehensive coverage. Which approach is BEST?

Accepted Answer

Use separate scan windows for Linux servers and Windows workstations with appropriate credentials and performance tuning. Using separate scan windows and credentials for each OS type minimizes disruption by scanning similar systems together and reduces load, while tailored credential profiles improve scan accuracy.

Answer

Deploy agents on all systems to perform continuous scanning

Answer

Scan all systems simultaneously with minimal plugin set to avoid performance issues

Answer

Schedule a single scan of all systems using default credentials and aggressive plugin settings

Question 4

A security analyst is reviewing a DAST scan report for a web application. The report indicates a vulnerability where the application fails to properly validate user-supplied data before using it in a database query. This is most likely which type of vulnerability?

Accepted Answer

Injection. Failure to validate user input before using in a database query is classic SQL injection (injection flaw).

Answer

Cross-site scripting (XSS)

Answer

Security misconfiguration

Answer

Broken access control

Question 5

Which tool is specifically designed to check Linux systems for compliance with security best practices and can be used for configuration auditing?

Accepted Answer

Lynis. Lynis is a security auditing tool for Linux/Unix systems that performs compliance checks and configuration reviews.

Answer

Burp Suite

Answer

OpenVAS

Answer

Nessus

Question 6

During a patch management process, a security analyst is testing a critical security patch in a staging environment. The patch is intended to fix a remote code execution vulnerability in a widely used application. What is the MOST important step before deploying to production?

Accepted Answer

Perform regression testing to ensure no breakage. Performing regression testing ensures that the patch does not introduce new issues or break existing functionality, which is critical before production deployment.

Answer

Check the patch's CVSS score

Answer

Verify the patch's digital signature

Answer

Automatically deploy to all production servers immediately

Question 7

A security analyst is investigating a containerized environment. A scan using Trivy has identified a critical vulnerability in a container image. The container is running in a Kubernetes cluster with a Pod Security Policy that disallows privileged containers. Which additional concern should the analyst address?

Accepted Answer

The analyst should immediately patch the image, but also verify that the Pod Security Policy prevents privilege escalation. Even if the container image has a vulnerability, the Pod Security Policy reduces risk by preventing privilege escalation. The analyst should ensure that the exploit cannot gain additional privileges due to the policy.

Answer

The vulnerability is not exploitable due to the Pod Security Policy

Answer

The vulnerability is automatically mitigated because the container is not privileged

Answer

The analyst should ignore the vulnerability because the container is not privileged

Question 8

A vulnerability scanner reports a finding with a CVSS v3.1 base score of 7.5 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. What does this indicate about the vulnerability?

Accepted Answer

It has high impact on availability. The vector shows high impact to availability (A:H) and no impact to confidentiality or integrity, so the vulnerability primarily affects availability.

Answer

It has high impact on integrity

Answer

It requires authentication to exploit

Answer

It has high impact on confidentiality

Question 9

Which of the following is the BEST description of configuration drift?

Accepted Answer

The gradual deviation of a system's configuration from the intended baseline. Configuration drift refers to the gradual change in system configurations over time, causing deviations from the baseline or security standards.

Answer

A planned change to a system's configuration

Answer

The process of reverting a system to its baseline configuration

Answer

A vulnerability that is patched and then reappears

Question 10

A security analyst is using OpenSCAP to perform a compliance scan against a set of RHEL servers. The analyst wants to ensure the servers comply with the CIS Benchmark Level 1 for Red Hat Enterprise Linux. What does Level 1 typically indicate?

Accepted Answer

A set of security controls that are considered best practices with minimal impact on functionality. CIS Benchmarks define Level 1 as basic security requirements that can be implemented with minimal impact on functionality, while Level 2 includes more stringent controls.

Answer

A custom profile defined by the organization

Answer

The most secure configuration possible

Answer

Configuration settings that are required for DoD environments

Question 11

During a web application penetration test using Burp Suite, a security analyst identifies that an API endpoint accepts a URL parameter that is used to fetch data from an external resource. The application does not validate or sanitize the parameter. This is most likely vulnerable to which attack?

Accepted Answer

Server-Side Request Forgery (SSRF). Server-Side Request Forgery (SSRF) occurs when an attacker can induce the server to make requests to arbitrary URLs, often by manipulating a URL parameter.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

XML External Entity (XXE)

Question 12

A vulnerability management team is evaluating whether to apply a patch immediately or implement a compensating control. The patch is for a vulnerability in a legacy system that cannot be taken offline during business hours. The compensating control would involve restricting network access to the system. Which decision is MOST appropriate?

Accepted Answer

Implement a compensating control and schedule patching during a maintenance window. If the system cannot be patched immediately, implementing a compensating control (network restriction) reduces risk while waiting for a maintenance window.

Answer

Ignore the vulnerability since it affects a legacy system

Answer

Remove the system from the network

Answer

Apply the patch immediately despite the outage risk

Question 13

A security analyst is performing a vulnerability assessment and needs to identify potential misconfigurations in a Kubernetes cluster. Which TWO of the following are common Kubernetes misconfigurations that should be checked? (Select TWO.)

Accepted Answer

Privileged containers. Privileged containers and hostPath mounts are well-known security risks in Kubernetes. The other options are not typical misconfigurations.

Answer

Using network policies

Answer

Running containers as non-root user

Answer

Using ConfigMaps for non-sensitive data

Question 14

A security analyst is reviewing the output of a vulnerability scanner that uses CVSS v3.1. The analyst wants to understand the impact metrics. Which THREE of the following are impact metrics in the CVSS v3.1 base score? (Select THREE.)

Accepted Answer

Confidentiality (C). CVSS v3.1 base score includes three impact metrics: Confidentiality (C), Integrity (I), and Availability (A). Attack Vector, Attack Complexity, Privileges Required, etc., are exploitability metrics.

Answer

Scope (S)

Answer

Attack Vector (AV)

Question 15

A security analyst is setting up a vulnerability management program and needs to select tools for container image scanning. Which THREE of the following are commonly used container image scanning tools? (Select THREE.)

Accepted Answer

Snyk. Trivy, Clair, and Snyk are well-known container image scanning tools. OpenVAS is a network vulnerability scanner, and Burp Suite is for web application testing.

Answer

OpenVAS

Answer

Burp Suite