CS0-003 Vulnerability Management Practice Test 3 — 15 Questions

Question 1

A cloud security analyst is reviewing a misconfiguration in an AWS S3 bucket that allows public read access. The bucket contains sensitive customer data. Which of the following CIS AWS Foundations Benchmark checks would most likely identify this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure S3 buckets do not allow public read access. CIS AWS Foundations Benchmark includes a control for ensuring S3 buckets do not allow public read access. The control is typically '1.5 Ensure S3 bucket policy restricts public read access'. 'Enable S3 bucket logging' is about logging, not access. 'Enable default encryption' is about encryption. 'Enable versioning' is about data protection.

Answer

Enable default encryption for S3 buckets

Answer

Enable S3 bucket logging

Answer

Enable versioning on S3 buckets

Question 2

A security analyst is reviewing a vulnerability scan report and finds a critical vulnerability with a CVSS v3.1 base score of 9.8. The vector string is: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which of the following best describes the attack vector and impact of this vulnerability?

Accepted Answer

Network attack vector, high impact on confidentiality, integrity, and availability. AV:N indicates network-based attack vector, meaning the vulnerability can be exploited remotely over the network. The CIA impact ratings are all High, indicating complete compromise of confidentiality, integrity, and availability.

Answer

Adjacent attack vector, high impact on availability only

Answer

Physical attack vector, medium impact on confidentiality

Answer

Local attack vector, low impact on confidentiality

Question 3

During a vulnerability assessment, a security analyst uses a tool that identifies missing patches and misconfigurations based on CIS Benchmarks. Which of the following tools is specifically designed for compliance scanning against CIS benchmarks?

Accepted Answer

OpenSCAP. OpenSCAP is a compliance scanning tool that can assess systems against security benchmarks such as CIS. It validates compliance with security policies.

Answer

Qualys

Answer

Nessus

Answer

OpenVAS

Question 4

A vulnerability scanner reports a plugin that identifies a web application vulnerability related to the failure to validate user input, allowing an attacker to inject malicious scripts that execute in other users' browsers. Which OWASP Top 10 category does this vulnerability fall under?

Accepted Answer

Injection. The description matches cross-site scripting (XSS), which is part of the OWASP Top 10 category 'Injection' (formerly separate, but in 2021 XSS is included in Injection).

Answer

Security Misconfiguration

Answer

Cryptographic Failures

Answer

Broken Access Control

Question 5

An analyst is prioritizing vulnerabilities for remediation. The vulnerability has a high CVSS score but is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and has a low EPSS score. The affected asset is a publicly accessible web server handling sensitive customer data. Which factor should the analyst consider as most critical for prioritization?

Accepted Answer

The business context of asset criticality and exposure. EPSS indicates likelihood of exploitation, but business context (asset criticality and exposure) can override low EPSS if the asset is high-value and exposed. Thus, the analyst should consider the business context.

Answer

The absence from the KEV catalog

Answer

The low EPSS score

Answer

The high CVSS score alone

Question 6

A security analyst is configuring a container image scanning tool to identify vulnerabilities in a Docker image before deployment. Which of the following tools is commonly used for container image scanning?

Accepted Answer

Trivy. Trivy is a popular open-source container image vulnerability scanner. It is widely used for scanning Docker images for known vulnerabilities.

Answer

Metasploit

Answer

Nmap

Answer

Wireshark

Question 7

During a patch management process, an organization uses a staging environment to test patches before deployment. Which of the following is the primary purpose of patch testing in a staging environment?

Accepted Answer

To validate that the patch addresses the vulnerability without causing regressions. Patch testing in a staging environment aims to identify potential issues (e.g., compatibility, regression) that could affect production systems, ensuring stability and minimizing disruptions.

Answer

To create a backup of production systems

Answer

To speed up the patch deployment process

Answer

To comply with licensing requirements

Question 8

A security analyst is reviewing a vulnerability scan of a Kubernetes cluster. The scan reports that a container is running with privileged mode enabled. Which CIS Kubernetes Benchmark recommendation does this violation relate to?

Accepted Answer

Ensure that containers are not running with privileged access. The CIS Kubernetes Benchmark includes a recommendation to avoid running containers with privileged access, as it increases security risks. This is a common misconfiguration.

Answer

Ensure that the cluster-admin role is not used

Answer

Ensure that the API server is not exposed to the internet

Answer

Ensure that etcd is configured with TLS

Question 9

Which of the following vulnerability lifecycle phases involves verifying that a remediation has been successfully applied and that the vulnerability no longer exists?

Accepted Answer

Verification. Verification is the phase where after remediation, the system is rescanned or checked to confirm the vulnerability is mitigated.

Answer

Discovery

Answer

Prioritization

Answer

Remediation

Question 10

An organization uses a DAST tool to test a web application for vulnerabilities. The tool sends specially crafted requests and analyzes responses. Which of the following vulnerabilities is a DAST tool most effective at identifying?

Accepted Answer

SQL injection. DAST tools are effective at finding runtime vulnerabilities like SQL injection, XSS, and other injection flaws by simulating attacks on the running application.

Answer

Outdated library versions in code

Answer

Insecure cryptographic algorithms in code

Answer

Hardcoded credentials in source code

Question 11

An organization is implementing configuration management and decides to use CIS Benchmarks to harden their servers. They choose Level 1 benchmarks for most servers but Level 2 for highly sensitive systems. What is the key difference between Level 1 and Level 2 CIS benchmarks?

Accepted Answer

Level 2 guidelines are more restrictive and may impact system functionality. CIS Level 1 benchmarks are basic security recommendations that can be implemented with minimal impact, while Level 2 includes more restrictive controls that may affect system functionality but provide higher security.

Answer

Level 1 is more restrictive and secure than Level 2

Answer

Level 1 is for cloud systems, Level 2 for on-premises

Answer

Level 2 is only for DoD environments

Question 12

A security analyst is conducting a vulnerability assessment on a cloud environment and needs to select a tool to scan for misconfigurations against the CIS AWS Foundations Benchmark. Which TWO of the following tools are capable of performing compliance scanning against cloud benchmarks? (Select TWO.)

Accepted Answer

OpenSCAP. OpenSCAP and cloud-specific tools like ScoutSuite (or Prowler) can assess cloud configurations against CIS benchmarks. Nessus and Qualys primarily do vulnerability scanning, though they may have some compliance modules, but the question expects tools specifically for cloud benchmarks. OpenSCAP can be used with cloud content, and ScoutSuite is a cloud security auditing tool.

Answer

Nessus

Answer

Qualys

Answer

Wireshark

Question 13

A security analyst is reviewing the results of a vulnerability scan. The analyst sees a plugin output that includes the CVSS vector string AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. What is the base score of this vulnerability?

Accepted Answer

9.8. The vector indicates Network attack vector, Low attack complexity, No privileges required, No user interaction, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. For CVSS v3.1, this corresponds to a base score of 9.8 (Critical).

Answer

6.5

Answer

10.0

Answer

7.5

Question 14

During a vulnerability assessment, a security analyst discovers a critical vulnerability affecting a legacy application that cannot be patched due to vendor end-of-life status. Which of the following is the BEST next step?

Accepted Answer

Document the risk and implement compensating controls. When a patch is not available, implementing compensating controls is the best approach to mitigate risk. This may include network segmentation, access controls, or additional monitoring.

Answer

Remove the legacy application from the network immediately

Answer

Disable the application until a patch becomes available

Answer

Apply a virtual patch via an intrusion prevention system

Question 15

A security team is using EPSS scores and CISA KEV catalog to prioritize vulnerabilities. Which combination of factors would indicate the HIGHEST priority for remediation?

Accepted Answer

High EPSS score and presence in KEV catalog. CISA KEV catalog contains vulnerabilities known to be exploited in the wild, and a high EPSS score indicates a high probability of exploitation. Together, they indicate the highest priority.

Answer

Medium CVSS score and high asset criticality

Answer

High CVSS score and low EPSS score

Answer

Low CVSS score and presence in KEV catalog