CS0-003 Vulnerability Management Practice Test 4 — 15 Questions

Question 1

A security analyst is reviewing a vulnerability scan report and sees a finding for a web application with a CVSS v3.1 base score of 6.1. The vector string is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. Which OWASP Top 10 category does this vulnerability most likely belong to?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A03: Injection. The vector indicates Reflected XSS (requires user interaction, scope change, low CIA impact). Reflected XSS is part of the OWASP Top 10 category 'Injection' (2017) or 'Cross-site Scripting' (2021). However, the most direct is Cross-site Scripting (XSS).

Answer

A05: Security Misconfiguration

Answer

A06: Vulnerable and Outdated Components

Answer

A01: Broken Access Control

Question 2

A security analyst is configuring a container image scanning tool. Which of the following tools is specifically designed for container image vulnerability scanning?

Accepted Answer

Trivy. Trivy is a popular open-source tool specifically designed for container image scanning, among others.

Answer

Nessus

Answer

Burp Suite

Answer

OpenVAS

Question 3

A security team is implementing CIS Benchmarks for a Linux server. They need to choose between Level 1 and Level 2 benchmarks. Which of the following best describes Level 1 benchmarks?

Accepted Answer

They are basic security settings that can be implemented with minimal disruption. CIS Level 1 benchmarks are intended to provide a baseline security configuration without causing significant operational impact.

Answer

They are mandatory for compliance with DoD STIGs

Answer

They are the most restrictive settings, suitable for high-security environments

Answer

They include advanced settings that require extensive testing

Question 4

During a web application penetration test, a security analyst uses a DAST tool and discovers that the application is vulnerable to Server-Side Request Forgery (SSRF). According to the OWASP Top 10 2021, under which category does SSRF fall?

Accepted Answer

A10: Server-Side Request Forgery (SSRF). In OWASP Top 10 2021, SSRF is a new category A10: Server-Side Request Forgery (SSRF).

Answer

A03: Injection

Answer

A01: Broken Access Control

Answer

A06: Vulnerable and Outdated Components

Question 5

An organization uses OpenSCAP for compliance scanning. What is the primary purpose of OpenSCAP?

Accepted Answer

Compliance scanning and configuration assessment. OpenSCAP is a tool for automated compliance checking against security policies like SCAP content.

Answer

Vulnerability scanning

Answer

Intrusion detection

Answer

Penetration testing

Question 6

A security analyst is reviewing a Kubernetes cluster configuration. Which of the following misconfigurations poses the MOST severe security risk?

Accepted Answer

Privileged containers with unrestricted host access. Privileged containers bypass all security restrictions and can access the host system, posing the most severe risk.

Answer

Using hostPath mounts with read-only access

Answer

Using ConfigMaps for non-sensitive data

Answer

Running containers as non-root user

Question 7

A vulnerability scan identifies a plugin output for 'SMB Signing Disabled' on a Windows server. The CVSS v3.1 base score is 5.3 (Medium). The asset is a file server used only internally. The organization has decided not to enable SMB signing due to performance concerns. Which of the following is the BEST compensating control?

Accepted Answer

Segment the file server into a separate VLAN with strict access controls. Since enabling SMB signing is not feasible, implementing network segmentation to restrict access to only authorized hosts reduces the attack surface.

Answer

Upgrade to SMB version 3.0 which has built-in signing

Answer

Accept the risk and document the decision

Answer

Apply a host-based firewall rule to block SMB traffic from all sources

Question 8

Which vulnerability scanner is an open-source tool commonly used for network vulnerability scanning?

Accepted Answer

OpenVAS. OpenVAS is a well-known open-source vulnerability scanner.

Answer

Qualys

Answer

Nessus

Answer

Rapid7 InsightVM

Question 9

A security analyst is performing a cloud security assessment for an AWS environment. Which THREE of the following configurations would be considered CIS AWS Foundations Benchmark violations?

Accepted Answer

Password policy does not require any complexity (lowercase only). The CIS AWS Foundations Benchmark requires IAM password policies to have a minimum length of 14 characters and to require at least one uppercase letter, one lowercase letter, one number, and one symbol. Option B only specifies a minimum length of 8 and at least one uppercase letter, which fails multiple CIS requirements and is therefore a violation. Options A, C, and D are also violations as identified. Thus, the correct options are A, B, C, and D, making the question's 'THREE' incorrect.

Answer

Root account has MFA enabled

Question 10

During a vulnerability scan, a security analyst identifies a critical vulnerability with a CVSS v3.1 base score of 9.8. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which component of this vector indicates that the vulnerability can be exploited without any user interaction?

Accepted Answer

UI:N. The UI (User Interaction) metric in the CVSS vector is set to N (None), meaning no user action is required for exploitation.

Answer

AC:L

Answer

AV:N

Answer

PR:N

Question 11

A vulnerability management analyst is reviewing scan results from a recent Nessus scan. The analyst notices a plugin with the output: 'The remote host is missing a security patch for CVE-2023-1234. The patch was released by the vendor on 2023-05-01.' Which phase of the vulnerability lifecycle is the analyst currently performing?

Accepted Answer

Discovery. The analyst is reviewing scan results to identify vulnerabilities, which is the discovery phase of the vulnerability lifecycle.

Answer

Prioritization

Answer

Remediation

Answer

Verification

Question 12

An organization uses Qualys for vulnerability scanning. After a scan, the security team identifies a vulnerability with an EPSS score of 0.95 and that appears in the CISA KEV catalog. However, the affected asset is a non-critical development server with no internet access. According to the vulnerability lifecycle, what should be the analyst's NEXT action?

Accepted Answer

Document the finding and schedule remediation during the next regular maintenance window.. Despite high EPSS and KEV listing, the asset's low business context (non-critical, no internet access) reduces risk; the analyst should prioritize based on business context, likely scheduling remediation with lower urgency.

Answer

Apply a compensating control, such as a firewall rule blocking access to the server.

Answer

Escalate the vulnerability to management for emergency patching.

Answer

Immediately patch the server within 48 hours due to the high EPSS score.

Question 13

A security analyst is configuring a vulnerability scanner for a new deployment. The scanner must be able to authenticate to targets to perform deep configuration audits against CIS Benchmarks. Which type of scan should the analyst configure?

Accepted Answer

Credentialed scan. Authenticated scans use credentials to access the target and perform deep configuration checks, such as CIS Benchmark compliance.

Answer

Unauthenticated scan

Answer

Passive scan

Answer

External scan

Question 14

During a web application security assessment using OWASP ZAP, a tester identifies that the application reflects user input in HTTP responses without proper encoding. Which OWASP Top 10 vulnerability category does this finding most likely belong to?

Accepted Answer

Injection. Reflected user input in responses without encoding is a classic sign of Cross-Site Scripting (XSS), which falls under injection in OWASP Top 10 (though XSS is specifically listed as a separate category in some versions, but in 2021 it is under injection).

Answer

Broken Access Control

Answer

Cryptographic Failures

Answer

Security Misconfiguration

Question 15

A security analyst is reviewing the results of a container image scan using Trivy. The scan reports a critical vulnerability in a base image layer. The development team states that the vulnerability is not exploitable because the affected library is not used in the application. According to vulnerability management best practices, what should the analyst do?

Accepted Answer

Request that the development team remove the unused library and rebuild the image.. Even if the library is not used, it is best practice to rebuild the image with a patched base image to eliminate the vulnerability and ensure compliance.

Answer

Accept the risk and close the finding.

Answer

Ignore the finding since it is not exploitable.

Answer

Apply a compensating control at the network level to block exploitation.