CS0-003 Vulnerability Management Practice Test 4 — 15 Questions

Question 1

A security analyst is reviewing a vulnerability scan report and finds a critical vulnerability with a CVSS v3.1 base score of 9.8. The vector string is: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which of the following best describes the attack vector and impact of this vulnerability?

Accepted Answer

Network attack vector, high impact on confidentiality, integrity, and availability. AV:N indicates network-based attack vector, meaning the vulnerability can be exploited remotely over the network. The CIA impact ratings are all High, indicating complete compromise of confidentiality, integrity, and availability.

Answer

Adjacent attack vector, high impact on availability only

Answer

Physical attack vector, medium impact on confidentiality

Answer

Local attack vector, low impact on confidentiality

Question 2

During a vulnerability assessment, a security analyst uses a tool that identifies missing patches and misconfigurations based on CIS Benchmarks. Which of the following tools is specifically designed for compliance scanning against CIS benchmarks?

Accepted Answer

OpenSCAP. OpenSCAP is a compliance scanning tool that can assess systems against security benchmarks such as CIS. It validates compliance with security policies.

Answer

Qualys

Answer

Nessus

Answer

OpenVAS

Question 3

A security team discovers a critical vulnerability in a widely used software component. The vulnerability has a CVSS score of 9.0, but there is no known exploit or patch available yet. However, the software vendor has released a workaround. According to the vulnerability management lifecycle, which action should the team prioritize first?

Accepted Answer

Apply the workaround as a compensating control. Since no patch is available, the team should apply compensating controls to mitigate the risk. Remediation typically involves patching, but if not possible, compensating controls are the next best step.

Answer

Wait for the vendor to release a patch before taking any action

Answer

Remove the affected component from all systems immediately

Answer

Increase monitoring of the affected systems but take no other action

Question 4

A vulnerability scanner reports a plugin that identifies a web application vulnerability related to the failure to validate user input, allowing an attacker to inject malicious scripts that execute in other users' browsers. Which OWASP Top 10 category does this vulnerability fall under?

Accepted Answer

Injection. The description matches cross-site scripting (XSS), which is part of the OWASP Top 10 category 'Injection' (formerly separate, but in 2021 XSS is included in Injection).

Answer

Security Misconfiguration

Answer

Cryptographic Failures

Answer

Broken Access Control

Question 5

An analyst is prioritizing vulnerabilities for remediation. The vulnerability has a high CVSS score but is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and has a low EPSS score. The affected asset is a publicly accessible web server handling sensitive customer data. Which factor should the analyst consider as most critical for prioritization?

Accepted Answer

The business context of asset criticality and exposure. EPSS indicates likelihood of exploitation, but business context (asset criticality and exposure) can override low EPSS if the asset is high-value and exposed. Thus, the analyst should consider the business context.

Answer

The absence from the KEV catalog

Answer

The low EPSS score

Answer

The high CVSS score alone

Question 6

A security analyst is configuring a container image scanning tool to identify vulnerabilities in a Docker image before deployment. Which of the following tools is commonly used for container image scanning?

Accepted Answer

Trivy. Trivy is a popular open-source container image vulnerability scanner. It is widely used for scanning Docker images for known vulnerabilities.

Answer

Metasploit

Answer

Nmap

Answer

Wireshark

Question 7

During a patch management process, an organization uses a staging environment to test patches before deployment. Which of the following is the primary purpose of patch testing in a staging environment?

Accepted Answer

To validate that the patch addresses the vulnerability without causing regressions. Patch testing in a staging environment aims to identify potential issues (e.g., compatibility, regression) that could affect production systems, ensuring stability and minimizing disruptions.

Answer

To create a backup of production systems

Answer

To speed up the patch deployment process

Answer

To comply with licensing requirements

Question 8

A security analyst is reviewing a vulnerability scan of a Kubernetes cluster. The scan reports that a container is running with privileged mode enabled. Which CIS Kubernetes Benchmark recommendation does this violation relate to?

Accepted Answer

Ensure that containers are not running with privileged access. The CIS Kubernetes Benchmark includes a recommendation to avoid running containers with privileged access, as it increases security risks. This is a common misconfiguration.

Answer

Ensure that the cluster-admin role is not used

Answer

Ensure that the API server is not exposed to the internet

Answer

Ensure that etcd is configured with TLS

Question 9

Which of the following vulnerability lifecycle phases involves verifying that a remediation has been successfully applied and that the vulnerability no longer exists?

Accepted Answer

Verification. Verification is the phase where after remediation, the system is rescanned or checked to confirm the vulnerability is mitigated.

Answer

Discovery

Answer

Prioritization

Answer

Remediation

Question 10

An organization uses a DAST tool to test a web application for vulnerabilities. The tool sends specially crafted requests and analyzes responses. Which of the following vulnerabilities is a DAST tool most effective at identifying?

Accepted Answer

SQL injection. DAST tools are effective at finding runtime vulnerabilities like SQL injection, XSS, and other injection flaws by simulating attacks on the running application.

Answer

Outdated library versions in code

Answer

Insecure cryptographic algorithms in code

Answer

Hardcoded credentials in source code

Question 11

A security analyst is evaluating a vulnerability with CVSS v3.1 base score: AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N. Which of the following best describes the scope and impact of this vulnerability?

Accepted Answer

Scope is changed, high impact on confidentiality only. The scope is Changed (S:C), meaning the vulnerable component impacts resources beyond its security scope. The impact is High on confidentiality (C:H), but none on integrity or availability.

Answer

Scope is unchanged, high impact on confidentiality only

Answer

Scope is changed, high impact on integrity only

Answer

Scope is unchanged, high impact on confidentiality and integrity

Question 12

An organization is implementing configuration management and decides to use CIS Benchmarks to harden their servers. They choose Level 1 benchmarks for most servers but Level 2 for highly sensitive systems. What is the key difference between Level 1 and Level 2 CIS benchmarks?

Accepted Answer

Level 2 guidelines are more restrictive and may impact system functionality. CIS Level 1 benchmarks are basic security recommendations that can be implemented with minimal impact, while Level 2 includes more restrictive controls that may affect system functionality but provide higher security.

Answer

Level 1 is more restrictive and secure than Level 2

Answer

Level 1 is for cloud systems, Level 2 for on-premises

Answer

Level 2 is only for DoD environments

Question 13

A security analyst is conducting a vulnerability assessment on a cloud environment and needs to select a tool to scan for misconfigurations against the CIS AWS Foundations Benchmark. Which TWO of the following tools are capable of performing compliance scanning against cloud benchmarks? (Select TWO.)

Accepted Answer

OpenSCAP. OpenSCAP and cloud-specific tools like ScoutSuite (or Prowler) can assess cloud configurations against CIS benchmarks. Nessus and Qualys primarily do vulnerability scanning, though they may have some compliance modules, but the question expects tools specifically for cloud benchmarks. OpenSCAP can be used with cloud content, and ScoutSuite is a cloud security auditing tool.

Answer

Nessus

Answer

Qualys

Answer

Wireshark

Question 14

A security analyst is reviewing the results of a web application vulnerability scan and needs to identify the vulnerabilities that are part of the OWASP Top 10 (2021) category 'Injection'. Which THREE of the following vulnerabilities fall under this category? (Select THREE.)

Accepted Answer

SQL injection. SQL injection, Cross-Site Scripting (XSS), and OS command injection are all types of injection flaws. XXE is also injection, but it is often listed separately; however, in OWASP Top 10 2021, Injection includes XSS, SQL injection, etc. Broken access control is a separate category.

Answer

Broken Access Control

Answer

Security Misconfiguration

Question 15

A vulnerability management team is prioritizing vulnerabilities for remediation. They have a list of vulnerabilities with different characteristics. According to best practices, which TWO factors should be considered when prioritizing vulnerabilities? (Select TWO.)

Accepted Answer

The asset's criticality to the business. Asset criticality (business context) and the presence of known exploits (e.g., KEV) are key prioritization factors. CVSS base score is a factor but not as dynamic. Patch availability is important but secondary to exploitability and business impact.

Answer

The CVSS base score

Answer

The availability of a patch

Answer

The number of open ports on the asset