CS0-003 Vulnerability Management Practice Test 3 — 15 Questions

Question 1

A security analyst is reviewing a vulnerability scan report from Rapid7 InsightVM. The report shows that a Tomcat server has a plugin finding indicating that the 'Server' header is set to 'Apache-Coyote/1.1', which reveals the server version. Which type of vulnerability does this represent?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security misconfiguration. The 'Server' header revealing the server version is a security misconfiguration because it exposes unnecessary information that could aid attackers in targeting known vulnerabilities. This falls under the OWASP Top 10 category of Security Misconfiguration. It is not a direct vulnerability but a configuration weakness that should be remediated by suppressing version details.

Answer

Broken access control

Answer

Injection vulnerability

Answer

Cryptographic failure

Question 2

A security analyst is prioritizing vulnerabilities for a critical internet-facing application server. The analyst has CVSS scores, EPSS scores, and access to the CISA KEV catalog. Which TWO factors should the analyst consider as the most important for determining remediation priority? (Select TWO)

Accepted Answer

Asset criticality and business context. Remediation priority must reflect the value and exposure of the affected system; a critical internet-facing application server supporting key business functions warrants higher priority than a low-value internal host, regardless of raw severity scores. Option E (CISA Known Exploited Vulnerabilities (KEV) catalog) is correct because KEV lists vulnerabilities known to be actively exploited in the wild, which is the strongest evidence of immediate real-world risk and should drive urgent remediation. CVSS base score (B) measures intrinsic technical severity but not exploit likelihood or business impact, so it is only one input and not the top priority factor. EPSS score (D) estimates the probability of exploitation but does not capture asset importance or confirmed exploitation like KEV does. The number of plugins detecting the vulnerability (C) is a scanner artifact and has no bearing on actual risk or remediation priority.

Answer

CVSS base score

Answer

Number of plugins detecting the vulnerability

Answer

EPSS score

Question 3

A security team is implementing container security scanning in their CI/CD pipeline. They want to scan container images for vulnerabilities and Kubernetes misconfigurations. Which THREE tools from the following list are best suited for this purpose? (Select THREE)

Accepted Answer

Trivy. Trivy (B) is a purpose-built container and Kubernetes scanner that detects OS package and language dependency CVEs in images and also checks Kubernetes manifests and cluster configurations for misconfigurations, making it a direct fit for both requirements. Clair (D) is an open-source static analyzer from CoreOS/Quay that inspects container image layers against vulnerability databases, so it is well suited for image vulnerability scanning in a CI/CD pipeline. Snyk (E) provides container image vulnerability scanning plus Kubernetes and IaC misconfiguration detection, and it integrates natively into CI/CD workflows, satisfying both stated goals. Burp Suite (A) is a web application security testing proxy for runtime HTTP traffic, not a container image or Kubernetes configuration scanner, so it does not belong. OpenSCAP (C) is a compliance and vulnerability scanner based on SCAP for hosts and operating systems, not for container image layers or Kubernetes misconfigurations, so it is not the best fit here.

Answer

Burp Suite

Answer

OpenSCAP

Question 4

A security analyst is reviewing a vulnerability scan report from Rapid7 InsightVM. The report shows that a Tomcat server has a plugin finding indicating that the 'Server' header is set to 'Apache-Coyote/1.1', which reveals the server version. Which type of vulnerability does this represent?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Network. AV:N indicates network attack vector, meaning the vulnerability can be exploited remotely over the network without any physical or local access.

Answer

Adjacent network

Answer

Local

Answer

Physical

Question 5

A vulnerability management team is prioritizing remediation of several vulnerabilities. They have access to EPSS scores and the CISA KEV catalog. Which factor should they consider FIRST when deciding which vulnerability to remediate?

Accepted Answer

The vulnerability listed in the CISA Known Exploited Vulnerabilities catalog. The CISA KEV catalog contains vulnerabilities that are actively exploited in the wild. These pose immediate risk and should be addressed before others, regardless of EPSS score or other factors.

Answer

The vulnerability with the highest base CVSS score

Answer

The vulnerability affecting the most critical asset

Answer

The vulnerability with the highest EPSS score

Question 6

A cybersecurity analyst is configuring a vulnerability scanning policy for a mixed environment of Linux servers and Windows workstations. The analyst wants to minimize disruption to production services while ensuring comprehensive coverage. Which approach is BEST?

Accepted Answer

Use separate scan windows for Linux servers and Windows workstations with appropriate credentials and performance tuning. Using separate scan windows and credentials for each OS type minimizes disruption by scanning similar systems together and reduces load, while tailored credential profiles improve scan accuracy.

Answer

Deploy agents on all systems to perform continuous scanning

Answer

Scan all systems simultaneously with minimal plugin set to avoid performance issues

Answer

Schedule a single scan of all systems using default credentials and aggressive plugin settings

Question 7

A security analyst is reviewing a DAST scan report for a web application. The report indicates a vulnerability where the application fails to properly validate user-supplied data before using it in a database query. This is most likely which type of vulnerability?

Accepted Answer

Injection. Failure to validate user input before using in a database query is classic SQL injection (injection flaw).

Answer

Cross-site scripting (XSS)

Answer

Security misconfiguration

Answer

Broken access control

Question 8

Which tool is specifically designed to check Linux systems for compliance with security best practices and can be used for configuration auditing?

Accepted Answer

Lynis. Lynis is a security auditing tool for Linux/Unix systems that performs compliance checks and configuration reviews.

Answer

Burp Suite

Answer

OpenVAS

Answer

Nessus

Question 9

During a patch management process, a security analyst is testing a critical security patch in a staging environment. The patch is intended to fix a remote code execution vulnerability in a widely used application. What is the MOST important step before deploying to production?

Accepted Answer

Perform regression testing to ensure no breakage. Regression testing is the most important step because a patch that fixes a remote code execution vulnerability can still introduce functional regressions or break dependent applications in production. Testing in staging validates that the patch resolves the vulnerability without breaking existing functionality, integrations, or workflows. This aligns with change management best practices where validation precedes production deployment.

Answer

Check the patch's CVSS score

Answer

Verify the patch's digital signature

Answer

Automatically deploy to all production servers immediately

Question 10

A security analyst is investigating a containerized environment. A scan using Trivy has identified a critical vulnerability in a container image. The container is running in a Kubernetes cluster with a Pod Security Policy that disallows privileged containers. Which additional concern should the analyst address?

Accepted Answer

The analyst should immediately patch the image, but also verify that the Pod Security Policy prevents privilege escalation. A critical vulnerability in a container image remains a real risk even if the container is not privileged, because the vulnerability could still be exploited for data exfiltration, denial of service, or lateral movement within the cluster. The analyst should patch the image and also verify that the Pod Security Policy actually prevents privilege escalation, since misconfigurations or policy gaps could allow an attacker to escalate privileges after exploiting the vulnerability.

Answer

The vulnerability is not exploitable due to the Pod Security Policy

Answer

The vulnerability is automatically mitigated because the container is not privileged

Answer

The analyst should ignore the vulnerability because the container is not privileged

Question 11

A vulnerability scanner reports a finding with a CVSS v3.1 base score of 7.5 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. What does this indicate about the vulnerability?

Accepted Answer

It has high impact on availability. The vector shows high impact to availability (A:H) and no impact to confidentiality or integrity, so the vulnerability primarily affects availability.

Answer

It has high impact on integrity

Answer

It requires authentication to exploit

Answer

It has high impact on confidentiality

Question 12

Which of the following is the BEST description of configuration drift?

Accepted Answer

The gradual deviation of a system's configuration from the intended baseline. Configuration drift refers to the gradual change in system configurations over time, causing deviations from the baseline or security standards.

Answer

A planned change to a system's configuration

Answer

The process of reverting a system to its baseline configuration

Answer

A vulnerability that is patched and then reappears

Question 13

A security analyst is using OpenSCAP to perform a compliance scan against a set of RHEL servers. The analyst wants to ensure the servers comply with the CIS Benchmark Level 1 for Red Hat Enterprise Linux. What does Level 1 typically indicate?

Accepted Answer

A set of security controls that are considered best practices with minimal impact on functionality. CIS Benchmarks define Level 1 as basic security requirements that can be implemented with minimal impact on functionality, while Level 2 includes more stringent controls.

Answer

A custom profile defined by the organization

Answer

The most secure configuration possible

Answer

Configuration settings that are required for DoD environments

Question 14

During a web application penetration test using Burp Suite, a security analyst identifies that an API endpoint accepts a URL parameter that is used to fetch data from an external resource. The application does not validate or sanitize the parameter. This is most likely vulnerable to which attack?

Accepted Answer

Server-Side Request Forgery (SSRF). When an application takes a user-supplied URL parameter and fetches content from it without validation, the server can be tricked into making requests to internal or external resources on the attacker's behalf. This is the classic definition of Server-Side Request Forgery (SSRF). The lack of validation or sanitization of the URL parameter is the key indicator, allowing attackers to reach internal metadata endpoints (e.g., 169.254.169.254) or internal services.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

XML External Entity (XXE)

Question 15

A vulnerability management team is evaluating whether to apply a patch immediately or implement a compensating control. The patch is for a vulnerability in a legacy system that cannot be taken offline during business hours. The compensating control would involve restricting network access to the system. Which decision is MOST appropriate?

Accepted Answer

Implement a compensating control and schedule patching during a maintenance window. If the system cannot be patched immediately, implementing a compensating control (network restriction) reduces risk while waiting for a maintenance window.

Answer

Ignore the vulnerability since it affects a legacy system

Answer

Remove the system from the network

Answer

Apply the patch immediately despite the outage risk