CS0-003 Vulnerability Management Practice Test 5 — 15 Questions

Question 1

A security analyst is reviewing the results of a vulnerability scan. The analyst sees a plugin output that includes the CVSS vector string AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. What is the base score of this vulnerability?

Accepted Answer

9.8. The vector indicates Network attack vector, Low attack complexity, No privileges required, No user interaction, Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. For CVSS v3.1, this corresponds to a base score of 9.8 (Critical).

Answer

6.5

Answer

10.0

Answer

7.5

Question 2

During a vulnerability assessment, a security analyst discovers a critical vulnerability affecting a legacy application that cannot be patched due to vendor end-of-life status. Which of the following is the BEST next step?

Accepted Answer

Document the risk and implement compensating controls. When a patch is not available, implementing compensating controls is the best approach to mitigate risk. This may include network segmentation, access controls, or additional monitoring.

Answer

Remove the legacy application from the network immediately

Answer

Disable the application until a patch becomes available

Answer

Apply a virtual patch via an intrusion prevention system

Question 3

A security team is using EPSS scores and CISA KEV catalog to prioritize vulnerabilities. Which combination of factors would indicate the HIGHEST priority for remediation?

Accepted Answer

High EPSS score and presence in KEV catalog. CISA KEV catalog contains vulnerabilities known to be exploited in the wild, and a high EPSS score indicates a high probability of exploitation. Together, they indicate the highest priority.

Answer

Medium CVSS score and high asset criticality

Answer

High CVSS score and low EPSS score

Answer

Low CVSS score and presence in KEV catalog

Question 4

A security analyst is reviewing a vulnerability scan report and sees a finding for a web application with a CVSS v3.1 base score of 6.1. The vector string is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. Which OWASP Top 10 category does this vulnerability most likely belong to?

Accepted Answer

A03: Injection. The vector indicates Reflected XSS (requires user interaction, scope change, low CIA impact). Reflected XSS is part of the OWASP Top 10 category 'Injection' (2017) or 'Cross-site Scripting' (2021). However, the most direct is Cross-site Scripting (XSS).

Answer

A05: Security Misconfiguration

Answer

A06: Vulnerable and Outdated Components

Answer

A01: Broken Access Control

Question 5

A security analyst is configuring a container image scanning tool. Which of the following tools is specifically designed for container image vulnerability scanning?

Accepted Answer

Trivy. Trivy is a popular open-source tool specifically designed for container image scanning, among others.

Answer

Nessus

Answer

Burp Suite

Answer

OpenVAS

Question 6

A security team is implementing CIS Benchmarks for a Linux server. They need to choose between Level 1 and Level 2 benchmarks. Which of the following best describes Level 1 benchmarks?

Accepted Answer

They are basic security settings that can be implemented with minimal disruption. CIS Level 1 benchmarks are intended to provide a baseline security configuration without causing significant operational impact.

Answer

They are mandatory for compliance with DoD STIGs

Answer

They are the most restrictive settings, suitable for high-security environments

Answer

They include advanced settings that require extensive testing

Question 7

During a web application penetration test, a security analyst uses a DAST tool and discovers that the application is vulnerable to Server-Side Request Forgery (SSRF). According to the OWASP Top 10 2021, under which category does SSRF fall?

Accepted Answer

A10: Server-Side Request Forgery (SSRF). In OWASP Top 10 2021, SSRF is a new category A10: Server-Side Request Forgery (SSRF).

Answer

A03: Injection

Answer

A01: Broken Access Control

Answer

A06: Vulnerable and Outdated Components

Question 8

A vulnerability management team has identified a critical vulnerability with a CVSS score of 9.8. The vulnerability affects a public-facing web server that handles sensitive customer data. The team decides to apply a patch immediately without going through the normal patch testing cycle. What type of patching procedure is this?

Accepted Answer

Emergency patching. When a critical vulnerability is actively exploited or poses immediate risk, emergency patching procedures are used to expedite deployment without standard testing.

Answer

Rolling patch deployment

Answer

Patch compliance tracking

Answer

Standard patch management

Question 9

An organization uses OpenSCAP for compliance scanning. What is the primary purpose of OpenSCAP?

Accepted Answer

Compliance scanning and configuration assessment. OpenSCAP is a tool for automated compliance checking against security policies like SCAP content.

Answer

Vulnerability scanning

Answer

Intrusion detection

Answer

Penetration testing

Question 10

A security analyst is reviewing a Kubernetes cluster configuration. Which of the following misconfigurations poses the MOST severe security risk?

Accepted Answer

Privileged containers with unrestricted host access. Privileged containers bypass all security restrictions and can access the host system, posing the most severe risk.

Answer

Using hostPath mounts with read-only access

Answer

Using ConfigMaps for non-sensitive data

Answer

Running containers as non-root user

Question 11

A vulnerability scan identifies a plugin output for 'SMB Signing Disabled' on a Windows server. The CVSS v3.1 base score is 5.3 (Medium). The asset is a file server used only internally. The organization has decided not to enable SMB signing due to performance concerns. Which of the following is the BEST compensating control?

Accepted Answer

Segment the file server into a separate VLAN with strict access controls. Since enabling SMB signing is not feasible, implementing network segmentation to restrict access to only authorized hosts reduces the attack surface.

Answer

Upgrade to SMB version 3.0 which has built-in signing

Answer

Accept the risk and document the decision

Answer

Apply a host-based firewall rule to block SMB traffic from all sources

Question 12

Which vulnerability scanner is an open-source tool commonly used for network vulnerability scanning?

Accepted Answer

OpenVAS. OpenVAS is a well-known open-source vulnerability scanner.

Answer

Qualys

Answer

Nessus

Answer

Rapid7 InsightVM

Question 13

A security analyst is reviewing the output of a vulnerability scan and sees a finding for a web application that uses a known vulnerable version of Apache Struts. Which TWO of the following actions should the analyst prioritize?

Accepted Answer

Update Apache Struts to the latest patched version. Updating the component to a patched version is the primary remediation. If a patch is not immediately available, a WAF rule can provide temporary protection.

Answer

Remove the Apache Struts component entirely

Answer

Reboot the web server to clear memory

Answer

Disable the web application until further notice

Question 14

A security analyst is performing a cloud security assessment for an AWS environment. Which THREE of the following configurations would be considered CIS AWS Foundations Benchmark violations?

Accepted Answer

Password policy does not require any complexity (lowercase only). CIS AWS Foundations Benchmark includes requirements for IAM password policy, CloudTrail logging, and root account security. MFA on root account is a best practice, but not having it is a violation. Disabling CloudTrail is a violation. A permissive password policy (no complexity) is a violation.

Answer

IAM password policy with minimum length of 8 characters and requires at least one uppercase letter

Answer

Root account has MFA enabled

Question 15

A security analyst is investigating a reported vulnerability in a web application. The team uses Burp Suite for DAST scanning. Which TWO of the following findings would be classified as injection vulnerabilities according to OWASP Top 10?

Accepted Answer

Stored XSS in the comment section. SQL injection and Stored XSS are both injection flaws. SQL injection is classic injection, and XSS is also a form of injection.

Answer

Use of a component with known vulnerabilities

Answer

Broken access control allowing privilege escalation

Answer

Security misconfiguration exposing directory listing