CS0-003 Vulnerability Management Practice Test 5 — 15 Questions

Question 1

Which of the following vulnerability scanning tools is open source and commonly used for network vulnerability assessment?

Accepted Answer

OpenVAS. OpenVAS is a well-known open-source vulnerability scanner.

Answer

Nessus

Answer

Qualys

Answer

Rapid7 InsightVM

Question 2

A security analyst is prioritizing vulnerabilities for remediation. One vulnerability has a CVSS v3.1 score of 7.5, an EPSS score of 0.02, and is not in the CISA KEV catalog. Another vulnerability has a CVSS score of 5.0, an EPSS score of 0.85, and is listed in the KEV catalog. Which vulnerability should be prioritized FIRST?

Accepted Answer

The vulnerability with CVSS 5.0. EPSS and KEV catalog provide real-world exploit intelligence. The vulnerability with high EPSS and KEV is more likely to be exploited, so it should be prioritized despite lower CVSS.

Answer

The vulnerability with CVSS 7.5

Answer

Both should be prioritized equally

Answer

Neither should be prioritized until a full risk assessment is done

Question 3

An organization uses OpenSCAP to perform compliance scanning against STIGs for DoD environments. A scan reveals that several systems are non-compliant with STIG ID: V-XXXXX requiring 'The system must disable the guest account.' The configuration drift detection tool shows that the guest account was re-enabled after a recent patch. What is the MOST effective course of action?

Accepted Answer

Update the system baseline to enforce the guest account disabled state via Group Policy.. Configuration drift indicates that patches or changes are reverting settings. The most effective action is to update the baseline configuration management tool (e.g., Group Policy) to enforce the setting automatically.

Answer

Apply an exception to the STIG requirement for these systems.

Answer

Re-run the OpenSCAP scan after the next patch cycle.

Answer

Manually disable the guest account on each non-compliant system.

Question 4

A web application security tester uses Burp Suite to test an API endpoint. The tester sends a request with a modified HTTP method and discovers that the API accepts DELETE requests on an endpoint that should only allow GET. This is an example of which OWASP Top 10 vulnerability?

Accepted Answer

Broken Access Control. Improper handling of HTTP methods can lead to broken access control, allowing unauthorized actions.

Answer

Injection

Answer

Security Misconfiguration

Answer

Server-Side Request Forgery (SSRF)

Question 5

Which metric in the CVSS v3.1 base score indicates the level of access an attacker needs to exploit a vulnerability?

Accepted Answer

Privileges Required (PR). Privileges Required (PR) indicates the level of privileges an attacker must have before successfully exploiting the vulnerability.

Answer

Attack Vector (AV)

Answer

Attack Complexity (AC)

Answer

User Interaction (UI)

Question 6

A company uses Lynis for compliance scanning on Linux servers. During a scan, Lynis reports that the system has world-writable files in critical directories. Which CIS Benchmark recommendation does this finding relate to?

Accepted Answer

Ensure no world-writable files exist. CIS Benchmarks include recommendations to restrict file permissions, such as ensuring no world-writable files exist in system directories.

Answer

Ensure system is configured to forward logs to a central server

Answer

Ensure permissions on /etc/shadow are configured

Answer

Ensure separate partition exists for /tmp

Question 7

A security analyst reviews a vulnerability scan report and identifies a critical vulnerability with a CVSS v3.1 base score of 9.8. The attack vector is 'Network', attack complexity is 'Low', privileges required is 'None', user interaction is 'None', scope is 'Unchanged', and all three CIA impacts are 'High'. Which additional factor should the analyst prioritize when deciding whether to apply a patch or a compensating control?

Accepted Answer

The EPSS score for the vulnerability. The EPSS score estimates the likelihood of exploitation in the wild, which helps prioritize remediation. CVSS alone does not indicate active exploitation.

Answer

The number of affected hosts

Answer

The OS type of the affected system

Answer

The vendor's patch release date

Question 8

During a vulnerability assessment, a security analyst uses Nessus to scan a network. Which type of scan is most appropriate to identify live hosts and open ports without causing significant disruption?

Accepted Answer

TCP SYN scan. A TCP SYN scan is stealthier and less intrusive than a full connect scan, making it suitable for initial discovery.

Answer

Full connect scan

Answer

UDP scan

Answer

Ping sweep

Question 9

A security analyst is reviewing a vulnerability scan report that includes a plugin output with the following CVSS v3.1 vector: AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H. Which of the following best describes the characteristics of this vulnerability?

Accepted Answer

Requires local access, high attack complexity, high privileges, and user interaction. The vector indicates local attack vector, high complexity, high privileges required, user interaction required, changed scope, and high impact on all three CIA metrics. This suggests a local privilege escalation vulnerability.

Answer

Easily exploitable by an unauthenticated remote attacker

Answer

Requires physical access to exploit

Answer

Remotely exploitable with low complexity

Question 10

A security analyst is configuring a compliance scan for a Linux server using CIS Benchmarks. The analyst must ensure the server meets Level 1 benchmarks. Which of the following is a characteristic of CIS Level 1 benchmarks?

Accepted Answer

They are practical and prudent, with a low impact on business functionality. Level 1 benchmarks are foundational and designed to have minimal impact on business operations while improving security.

Answer

They are only applicable to cloud environments

Answer

They provide specific STIG requirements for DoD systems

Answer

They are intended for high-security environments and may impact performance

Question 11

A security analyst is evaluating a containerized application for vulnerabilities. The analyst runs Trivy on the container image and finds several high-severity vulnerabilities in the base image. Which of the following is the most effective remediation strategy?

Accepted Answer

Rebuild the image using a patched base image and redeploy. Rebuilding the container image with a patched base image addresses the root cause by eliminating vulnerable components.

Answer

Use a runtime security tool to monitor the container

Answer

Apply a host-based firewall to block exploitation attempts

Answer

Disable the container until a patch is available

Question 12

An organization wants to prioritize vulnerabilities based on the likelihood of exploitation. Which of the following sources provides a data-driven probability score for exploitation?

Accepted Answer

EPSS. EPSS uses real-world data to predict the probability of exploitation, aiding in prioritization.

Answer

CVSS v3.1

Answer

CIS Benchmarks

Answer

OWASP Top 10

Question 13

A security analyst is using a DAST tool to test a web application. Which of the following vulnerabilities would the tool most likely identify?

Accepted Answer

SQL injection. DAST tools interact with the running application and can detect vulnerabilities like SQL injection by sending malicious inputs and observing responses.

Answer

Hardcoded credentials in source code

Answer

Outdated library versions

Answer

Insecure cryptographic algorithms in configuration

Question 14

An organization uses OpenSCAP to perform compliance scanning. The scan results indicate that a system fails to meet a STIG requirement. Which of the following best describes the purpose of STIGs?

Accepted Answer

They are developed by the DoD to secure its information systems. STIGs are detailed security configuration guides for DoD systems, providing hardening requirements.

Answer

They are used solely for web application security

Answer

They are vulnerability scoring standards

Answer

They are industry-standard benchmarks for cloud security

Question 15

A security analyst discovers a critical vulnerability in a web application that allows an attacker to trigger server-side requests from the application server. Which OWASP Top 10 category does this vulnerability belong to?

Accepted Answer

Server-Side Request Forgery (SSRF). Server-Side Request Forgery (SSRF) is a distinct category in OWASP Top 10 (A10:2021).

Answer

Broken Access Control

Answer

Security Misconfiguration

Answer

Injection