CS0-003 Vulnerability Management Practice Test 3 — 15 Questions

Question 1

A security analyst reviews a Nessus scan result for a web server. The plugin output indicates a critical vulnerability with CVSS v3.1 base score 9.8. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which of the following best describes the attack complexity?

Accepted Answer

Low. In the CVSS vector, AC:L means Attack Complexity is Low, indicating no special conditions are required for exploitation.

Answer

Critical

Answer

Medium

Answer

High

Question 2

During a vulnerability scan, an analyst identifies a plugin that reports a vulnerability with a CVSS v3.1 base score of 7.5. The vector string includes AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Which of the following is the primary impact of this vulnerability?

Accepted Answer

Availability. The CIA impact ratings show A:H (Availability High), meaning the vulnerability primarily impacts availability. C:N and I:N indicate no impact on confidentiality or integrity.

Answer

Integrity

Answer

Scope change

Answer

Confidentiality

Question 3

A vulnerability management team is prioritizing remediation of a list of vulnerabilities. They want to incorporate the likelihood of exploitation based on real-world exploit activity. Which of the following data sources should they use?

Accepted Answer

EPSS. The Exploit Prediction Scoring System (EPSS) uses real-world exploit data to predict the likelihood of exploitation. KEV lists known exploited vulnerabilities but is not a scoring system. CVSS and CVE are not probabilistic.

Answer

CVE

Answer

CVSS

Answer

KEV

Question 4

An analyst is reviewing a vulnerability scan report for a containerized application. The scan identifies a critical vulnerability in a base image used by multiple containers. The application is deployed in a Kubernetes cluster with network policies restricting ingress. The vulnerability has a CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). However, the EPSS score is 0.001 (0.1%). Which of the following should the analyst prioritize?

Accepted Answer

Schedule the patch for the next maintenance window because of low EPSS and network controls. Despite high CVSS, the EPSS score indicates extremely low likelihood of exploitation in the wild. The business context and compensating controls (network policies) reduce risk. Therefore, remediation can be scheduled in normal patch cycle.

Answer

Apply a virtual patch via a web application firewall (WAF)

Answer

Ignore the vulnerability because it is in a container image

Answer

Immediately patch the vulnerability within 24 hours due to the high CVSS score

Question 5

A security analyst is configuring a vulnerability scan using OpenVAS. The scan should identify missing patches on Windows servers. Which of the following scan types should the analyst select?

Accepted Answer

Credentialed scan. OpenVAS uses authenticated scans to check for missing patches. Unauthenticated scans only detect open ports and services. A credentialed scan with valid credentials allows checking patch levels.

Answer

Passive scan

Answer

Unauthenticated scan

Answer

Port scan

Question 6

An organization uses CIS Benchmarks to secure its Linux servers. The security team applies Level 1 benchmarks. Which of the following best describes Level 1 CIS benchmarks?

Accepted Answer

Basic security configurations with minimal operational impact. CIS Level 1 benchmarks are basic security configurations that cause minimal disruption to business operations. Level 2 is more restrictive and may impact functionality.

Answer

Advanced security settings that may reduce functionality

Answer

Required for all internet-facing systems

Answer

Only applicable to DoD environments

Question 7

A security analyst is reviewing a DAST scan result for a web application. The scanner reports a finding that allows an attacker to redirect users to a malicious site via a parameter in the URL. Which OWASP Top 10 category does this finding most likely belong to?

Accepted Answer

A05:2021 – Security Misconfiguration. Open redirect vulnerabilities are classified under Security Misconfiguration or sometimes under A03:2021 – Injection? Actually OWASP Top 10 2021 includes 'Security Misconfiguration' (A05). Open redirect is typically a security misconfiguration. However, more precisely, it's often considered under 'Broken Access Control'? No, open redirect is not access control. The closest is Security Misconfiguration because it involves improper handling of redirect parameters.

Answer

A08:2021 – Software and Data Integrity Failures

Answer

A03:2021 – Injection

Answer

A01:2021 – Broken Access Control

Question 8

A vulnerability management team is evaluating a critical vulnerability in a legacy application that cannot be patched. The application is used by a small number of users internally. Which of the following is the best compensating control to reduce risk?

Accepted Answer

Implement network segmentation to restrict access to the application. When patching is not possible, compensating controls like network segmentation can limit exposure. Disabling the application would impact business. Application whitelisting might be too broad. Encryption doesn't prevent exploitation of the vulnerability.

Answer

Enable application whitelisting on all endpoints

Answer

Encrypt all data in transit

Answer

Disable the application until a patch is available

Question 9

An analyst uses Trivy to scan a container image in a CI/CD pipeline. The scan identifies a vulnerability in an open-source library included in the image. The library is not used by the application code. Which of the following actions should the analyst recommend?

Accepted Answer

Remove the unused library from the image. Unused components should be removed to reduce attack surface. Patching the library might be unnecessary if not used. Adding a WAF doesn't fix container image vulnerabilities. Accepting risk may be justified but removal is better.

Answer

Accept the risk because the library is not used

Answer

Add a web application firewall (WAF) to protect the container

Answer

Patch the library to the latest version

Question 10

Which of the following tools is specifically designed for compliance scanning against security benchmarks on Linux systems?

Accepted Answer

Lynis. Lynis is a security auditing tool for Linux/Unix that checks compliance with benchmarks. OpenSCAP is also a compliance scanner, but Lynis is more commonly used for initial audits. Nessus is a vulnerability scanner, not solely compliance. Qualys is a cloud-based vulnerability management platform.

Answer

OpenVAS

Answer

Nessus

Answer

Qualys

Question 11

During a patch management process, a security analyst is testing a critical security patch in a staging environment. The patch causes a regression in a key business application. Which of the following should the analyst do next?

Accepted Answer

Report the regression to the vendor and wait for a fixed patch. If regression occurs, the patch should not be deployed to production. The analyst should report the issue to the vendor and seek a fix. Deploying anyway could cause outages. Skipping the patch might leave systems vulnerable, but the regression must be addressed first.

Answer

Apply the patch to production but roll back if issues occur

Answer

Skip the patch and accept the risk

Answer

Deploy the patch to production and monitor for issues

Question 12

A cloud security analyst is reviewing a misconfiguration in an AWS S3 bucket that allows public read access. The bucket contains sensitive customer data. Which of the following CIS AWS Foundations Benchmark checks would most likely identify this issue?

Accepted Answer

Ensure S3 buckets do not allow public read access. CIS AWS Foundations Benchmark includes a control for ensuring S3 buckets do not allow public read access. The control is typically '1.5 Ensure S3 bucket policy restricts public read access'. 'Enable S3 bucket logging' is about logging, not access. 'Enable default encryption' is about encryption. 'Enable versioning' is about data protection.

Answer

Enable default encryption for S3 buckets

Answer

Enable S3 bucket logging

Answer

Enable versioning on S3 buckets

Question 13

A security analyst is using Burp Suite to test a web application for vulnerabilities. Which TWO of the following are common web application vulnerabilities that can be detected using Burp Suite? (Select TWO)

Accepted Answer

Cross-site scripting (XSS). Burp Suite can detect SQL injection and XSS through its scanner and manual testing tools. Buffer overflow and race conditions are typically not web application vulnerabilities detected by web proxies. Insecure deserialization can be detected but is less common than SQLi and XSS.

Answer

Buffer overflow

Answer

Insecure deserialization

Answer

Race condition

Question 14

A vulnerability management analyst is prioritizing vulnerabilities for remediation. The analyst has the following information for three vulnerabilities: CVE-2023-1: CVSS 9.8, EPSS 0.9, asset criticality high; CVE-2023-2: CVSS 7.5, EPSS 0.01, asset criticality low; CVE-2023-3: CVSS 5.0, EPSS 0.8, asset criticality medium. According to best practices, which THREE factors should the analyst consider when prioritizing? (Select THREE)

Accepted Answer

CVSS score. Prioritization should consider severity (CVSS), likelihood of exploitation (EPSS), and asset criticality. KEV is not mentioned in the data. Patch complexity and vendor reputation are secondary considerations but not primary factors in this context.

Answer

CVE publication date

Answer

Number of vendors affected

Question 15

An organization is implementing security hardening for Kubernetes clusters. Which THREE of the following are common Kubernetes misconfigurations that should be addressed? (Select THREE)

Accepted Answer

Using hostPath mounts without restrictions. Privileged containers, hostPath mounts, and overly permissive RBAC are common Kubernetes security issues. Using namespaces is good practice, not a misconfiguration. Network policies are recommended for segmentation.

Answer

Using namespaces to isolate workloads

Answer

Implementing network policies