CS0-003 Vulnerability Management Practice Test 2 — 15 Questions

Question 1

A security analyst is reviewing a DAST scan report for a web application. The report indicates a vulnerability where the application fails to properly validate user-supplied data before using it in a database query. This is most likely which type of vulnerability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Injection. Failure to validate user input before using in a database query is classic SQL injection (injection flaw).

Answer

Cross-site scripting (XSS)

Answer

Security misconfiguration

Answer

Broken access control

Question 2

Which tool is specifically designed to check Linux systems for compliance with security best practices and can be used for configuration auditing?

Accepted Answer

Lynis. Lynis is a security auditing tool for Linux/Unix systems that performs compliance checks and configuration reviews.

Answer

Burp Suite

Answer

OpenVAS

Answer

Nessus

Question 3

During a patch management process, a security analyst is testing a critical security patch in a staging environment. The patch is intended to fix a remote code execution vulnerability in a widely used application. What is the MOST important step before deploying to production?

Accepted Answer

Perform regression testing to ensure no breakage. Performing regression testing ensures that the patch does not introduce new issues or break existing functionality, which is critical before production deployment.

Answer

Check the patch's CVSS score

Answer

Verify the patch's digital signature

Answer

Automatically deploy to all production servers immediately

Question 4

A security analyst is investigating a containerized environment. A scan using Trivy has identified a critical vulnerability in a container image. The container is running in a Kubernetes cluster with a Pod Security Policy that disallows privileged containers. Which additional concern should the analyst address?

Accepted Answer

The analyst should immediately patch the image, but also verify that the Pod Security Policy prevents privilege escalation. Even if the container image has a vulnerability, the Pod Security Policy reduces risk by preventing privilege escalation. The analyst should ensure that the exploit cannot gain additional privileges due to the policy.

Answer

The vulnerability is not exploitable due to the Pod Security Policy

Answer

The vulnerability is automatically mitigated because the container is not privileged

Answer

The analyst should ignore the vulnerability because the container is not privileged

Question 5

A security analyst is using OpenSCAP to perform a compliance scan against a set of RHEL servers. The analyst wants to ensure the servers comply with the CIS Benchmark Level 1 for Red Hat Enterprise Linux. What does Level 1 typically indicate?

Accepted Answer

A set of security controls that are considered best practices with minimal impact on functionality. CIS Benchmarks define Level 1 as basic security requirements that can be implemented with minimal impact on functionality, while Level 2 includes more stringent controls.

Answer

A custom profile defined by the organization

Answer

The most secure configuration possible

Answer

Configuration settings that are required for DoD environments

Question 6

During a web application penetration test using Burp Suite, a security analyst identifies that an API endpoint accepts a URL parameter that is used to fetch data from an external resource. The application does not validate or sanitize the parameter. This is most likely vulnerable to which attack?

Accepted Answer

Server-Side Request Forgery (SSRF). Server-Side Request Forgery (SSRF) occurs when an attacker can induce the server to make requests to arbitrary URLs, often by manipulating a URL parameter.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

XML External Entity (XXE)

Question 7

During a vulnerability scan, an analyst identifies a plugin that reports a vulnerability with a CVSS v3.1 base score of 7.5. The vector string includes AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Which of the following is the primary impact of this vulnerability?

Accepted Answer

Availability. The CIA impact ratings show A:H (Availability High), meaning the vulnerability primarily impacts availability. C:N and I:N indicate no impact on confidentiality or integrity.

Answer

Integrity

Answer

Scope change

Answer

Confidentiality

Question 8

A vulnerability management team is prioritizing remediation of a list of vulnerabilities. They want to incorporate the likelihood of exploitation based on real-world exploit activity. Which of the following data sources should they use?

Accepted Answer

EPSS. The Exploit Prediction Scoring System (EPSS) uses real-world exploit data to predict the likelihood of exploitation. KEV lists known exploited vulnerabilities but is not a scoring system. CVSS and CVE are not probabilistic.

Answer

CVE

Answer

CVSS

Answer

KEV

Question 9

An analyst is reviewing a vulnerability scan report for a containerized application. The scan identifies a critical vulnerability in a base image used by multiple containers. The application is deployed in a Kubernetes cluster with network policies restricting ingress. The vulnerability has a CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). However, the EPSS score is 0.001 (0.1%). Which of the following should the analyst prioritize?

Accepted Answer

Schedule the patch for the next maintenance window because of low EPSS and network controls. Despite high CVSS, the EPSS score indicates extremely low likelihood of exploitation in the wild. The business context and compensating controls (network policies) reduce risk. Therefore, remediation can be scheduled in normal patch cycle.

Answer

Apply a virtual patch via a web application firewall (WAF)

Answer

Ignore the vulnerability because it is in a container image

Answer

Immediately patch the vulnerability within 24 hours due to the high CVSS score

Question 10

A security analyst is configuring a vulnerability scan using OpenVAS. The scan should identify missing patches on Windows servers. Which of the following scan types should the analyst select?

Accepted Answer

Credentialed scan. OpenVAS uses authenticated scans to check for missing patches. Unauthenticated scans only detect open ports and services. A credentialed scan with valid credentials allows checking patch levels.

Answer

Passive scan

Answer

Unauthenticated scan

Answer

Port scan

Question 11

A security analyst is reviewing a DAST scan report for a web application. The report indicates a vulnerability where the application fails to properly validate user-supplied data before using it in a database query. This is most likely which type of vulnerability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A05:2021 – Security Misconfiguration. Open redirect vulnerabilities are classified under Security Misconfiguration or sometimes under A03:2021 – Injection? Actually OWASP Top 10 2021 includes 'Security Misconfiguration' (A05). Open redirect is typically a security misconfiguration. However, more precisely, it's often considered under 'Broken Access Control'? No, open redirect is not access control. The closest is Security Misconfiguration because it involves improper handling of redirect parameters.

Answer

A08:2021 – Software and Data Integrity Failures

Answer

A03:2021 – Injection

Answer

A01:2021 – Broken Access Control

Question 12

A vulnerability management team is evaluating a critical vulnerability in a legacy application that cannot be patched. The application is used by a small number of users internally. Which of the following is the best compensating control to reduce risk?

Accepted Answer

Implement network segmentation to restrict access to the application. When patching is not possible, compensating controls like network segmentation can limit exposure. Disabling the application would impact business. Application whitelisting might be too broad. Encryption doesn't prevent exploitation of the vulnerability.

Answer

Enable application whitelisting on all endpoints

Answer

Encrypt all data in transit

Answer

Disable the application until a patch is available

Question 13

An analyst uses Trivy to scan a container image in a CI/CD pipeline. The scan identifies a vulnerability in an open-source library included in the image. The library is not used by the application code. Which of the following actions should the analyst recommend?

Accepted Answer

Remove the unused library from the image. Unused components should be removed to reduce attack surface. Patching the library might be unnecessary if not used. Adding a WAF doesn't fix container image vulnerabilities. Accepting risk may be justified but removal is better.

Answer

Accept the risk because the library is not used

Answer

Add a web application firewall (WAF) to protect the container

Answer

Patch the library to the latest version

Question 14

Which of the following tools is specifically designed for compliance scanning against security benchmarks on Linux systems?

Accepted Answer

Lynis. Lynis is a security auditing tool for Linux/Unix that checks compliance with benchmarks. OpenSCAP is also a compliance scanner, but Lynis is more commonly used for initial audits. Nessus is a vulnerability scanner, not solely compliance. Qualys is a cloud-based vulnerability management platform.

Answer

OpenVAS

Answer

Nessus

Answer

Qualys

Question 15

During a patch management process, a security analyst is testing a critical security patch in a staging environment. The patch causes a regression in a key business application. Which of the following should the analyst do next?

Accepted Answer

Report the regression to the vendor and wait for a fixed patch. If regression occurs, the patch should not be deployed to production. The analyst should report the issue to the vendor and seek a fix. Deploying anyway could cause outages. Skipping the patch might leave systems vulnerable, but the regression must be addressed first.

Answer

Apply the patch to production but roll back if issues occur

Answer

Skip the patch and accept the risk

Answer

Deploy the patch to production and monitor for issues