CS0-003 Vulnerability Management Practice Test 6 — 15 Questions

Question 1

A security team is using EPSS scores and CISA KEV catalog to prioritize vulnerabilities. Which combination of factors would indicate the HIGHEST priority for remediation?

Accepted Answer

High EPSS score and presence in KEV catalog. CISA KEV catalog contains vulnerabilities known to be exploited in the wild, and a high EPSS score indicates a high probability of exploitation. Together, they indicate the highest priority.

Answer

Medium CVSS score and high asset criticality

Answer

High CVSS score and low EPSS score

Answer

Low CVSS score and presence in KEV catalog

Question 2

A security analyst is reviewing a vulnerability scan report and sees a finding for a web application with a CVSS v3.1 base score of 6.1. The vector string is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. Which OWASP Top 10 category does this vulnerability most likely belong to?

Accepted Answer

A03: Injection. The vector indicates Reflected XSS (requires user interaction, scope change, low CIA impact). Reflected XSS is part of the OWASP Top 10 category 'Injection' (2017) or 'Cross-site Scripting' (2021). However, the most direct is Cross-site Scripting (XSS).

Answer

A05: Security Misconfiguration

Answer

A06: Vulnerable and Outdated Components

Answer

A01: Broken Access Control

Question 3

A security analyst is configuring a container image scanning tool. Which of the following tools is specifically designed for container image vulnerability scanning?

Accepted Answer

Trivy. Trivy is an open-source, purpose-built vulnerability scanner for container images, filesystems, and Git repositories. It scans OS packages (e.g., Alpine apk, Debian dpkg) and language-specific dependencies (npm, pip, Maven) inside an image and reports CVEs with severity ratings. Unlike general-purpose scanners, Trivy understands image layers and package manifests, making it the tool specifically designed for container image scanning in this list.

Answer

Nessus

Answer

Burp Suite

Answer

OpenVAS

Question 4

A security team is implementing CIS Benchmarks for a Linux server. They need to choose between Level 1 and Level 2 benchmarks. Which of the following best describes Level 1 benchmarks?

Accepted Answer

They are basic security settings that can be implemented with minimal disruption. CIS Level 1 benchmarks are defined as basic, essential security settings that can be applied with minimal disruption to functionality and are intended for all systems. They represent a practical baseline that most organizations can implement without extensive testing or performance impact, making them suitable as a starting point for hardening. This matches option A's description of basic settings with minimal disruption.

Answer

They are mandatory for compliance with DoD STIGs

Answer

They are the most restrictive settings, suitable for high-security environments

Answer

They include advanced settings that require extensive testing

Question 5

During a web application penetration test, a security analyst uses a DAST tool and discovers that the application is vulnerable to Server-Side Request Forgery (SSRF). According to the OWASP Top 10 2021, under which category does SSRF fall?

Accepted Answer

A10: Server-Side Request Forgery (SSRF). In the OWASP Top 10 2021, Server-Side Request Forgery (SSRF) was added as a new category, A10: Server-Side Request Forgery (SSRF). This category specifically addresses vulnerabilities where an attacker can induce the server to make requests to unintended locations, such as internal services or external systems.

Answer

A03: Injection

Answer

A01: Broken Access Control

Answer

A06: Vulnerable and Outdated Components

Question 6

A vulnerability management team has identified a critical vulnerability with a CVSS score of 9.8. The vulnerability affects a public-facing web server that handles sensitive customer data. The team decides to apply a patch immediately without going through the normal patch testing cycle. What type of patching procedure is this?

Accepted Answer

Emergency patching. When a critical vulnerability is actively exploited or poses immediate risk, emergency patching procedures are used to expedite deployment without standard testing.

Answer

Rolling patch deployment

Answer

Patch compliance tracking

Answer

Standard patch management

Question 7

An organization uses OpenSCAP for compliance scanning. What is the primary purpose of OpenSCAP?

Accepted Answer

Compliance scanning and configuration assessment. OpenSCAP is a tool for automated compliance checking against security policies like SCAP content.

Answer

Vulnerability scanning

Answer

Intrusion detection

Answer

Penetration testing

Question 8

A security analyst is reviewing a Kubernetes cluster configuration. Which of the following misconfigurations poses the MOST severe security risk?

Accepted Answer

Privileged containers with unrestricted host access. Privileged containers bypass all security restrictions and can access the host system, posing the most severe risk.

Answer

Using hostPath mounts with read-only access

Answer

Using ConfigMaps for non-sensitive data

Answer

Running containers as non-root user

Question 9

Which vulnerability scanner is an open-source tool commonly used for network vulnerability scanning?

Accepted Answer

OpenVAS. OpenVAS is a well-known open-source vulnerability scanner.

Answer

Qualys

Answer

Nessus

Answer

Rapid7 InsightVM

Question 10

A security analyst is reviewing the output of a vulnerability scan and sees a finding for a web application that uses a known vulnerable version of Apache Struts. Which TWO of the following actions should the analyst prioritize?

Accepted Answer

Update Apache Struts to the latest patched version. Option C is correct because upgrading Apache Struts to the latest patched version directly remediates the underlying vulnerability (e.g., the CVE affecting that specific Struts release) and eliminates the exploitable code path. Option E is correct because a WAF rule blocking known exploit patterns (such as OGNL injection payloads targeting Struts' Content-Type or action parameters) provides immediate compensating protection while the patch is scheduled and deployed. Option A is not appropriate as a priority action because removing the Struts component entirely would likely break the web application's functionality rather than remediate it. Option B is irrelevant because rebooting the web server does not remove or patch the vulnerable Struts library and provides no security benefit. Option D is overly disruptive; taking the application offline is a last resort and not a prioritized remediation step when patching and WAF mitigation are available.

Answer

Remove the Apache Struts component entirely

Answer

Reboot the web server to clear memory

Answer

Disable the web application until further notice

Question 11

A security analyst is investigating a reported vulnerability in a web application. The team uses Burp Suite for DAST scanning. Which TWO of the following findings would be classified as injection vulnerabilities according to OWASP Top 10?

Accepted Answer

Stored XSS in the comment section. Option C (Stored XSS in the comment section) is correct because cross-site scripting is classified under OWASP Top 10 A03:2021 Injection, where untrusted user input is interpreted as code (HTML/JavaScript) by the browser, and the stored variant persists the payload in the application's database. Option E (SQL injection in the login form) is correct because SQLi is the canonical injection flaw, where attacker-supplied input alters the structure of a SQL query executed by the backend database, also falling under A03:2021 Injection. Option A does not belong because using a component with known vulnerabilities maps to A06:2021 Vulnerable and Outdated Components, not injection. Option B does not belong because broken access control is its own category, A01:2021, involving authorization failures rather than input being interpreted as code or commands. Option D does not belong because security misconfiguration maps to A05:2021 and concerns improper hardening (such as exposed directory listings), not injection.

Answer

Use of a component with known vulnerabilities

Answer

Broken access control allowing privilege escalation

Answer

Security misconfiguration exposing directory listing

Question 12

During a vulnerability scan, a security analyst identifies a critical vulnerability with a CVSS v3.1 base score of 9.8. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which component of this vector indicates that the vulnerability can be exploited without any user interaction?

Accepted Answer

UI:N. The UI (User Interaction) metric in the CVSS vector is set to N (None), meaning no user action is required for exploitation.

Answer

AC:L

Answer

AV:N

Answer

PR:N

Question 13

A vulnerability management analyst is reviewing scan results from a recent Nessus scan. The analyst notices a plugin with the output: 'The remote host is missing a security patch for CVE-2023-1234. The patch was released by the vendor on 2023-05-01.' Which phase of the vulnerability lifecycle is the analyst currently performing?

Accepted Answer

Discovery. The analyst is reviewing scan results to identify vulnerabilities, which is the discovery phase of the vulnerability lifecycle.

Answer

Prioritization

Answer

Remediation

Answer

Verification

Question 14

An organization uses Qualys for vulnerability scanning. After a scan, the security team identifies a vulnerability with an EPSS score of 0.95 and that appears in the CISA KEV catalog. However, the affected asset is a non-critical development server with no internet access. According to the vulnerability lifecycle, what should be the analyst's NEXT action?

Accepted Answer

Document the finding and schedule remediation during the next regular maintenance window.. Despite high EPSS and KEV listing, the asset's low business context (non-critical, no internet access) reduces risk; the analyst should prioritize based on business context, likely scheduling remediation with lower urgency.

Answer

Apply a compensating control, such as a firewall rule blocking access to the server.

Answer

Escalate the vulnerability to management for emergency patching.

Answer

Immediately patch the server within 48 hours due to the high EPSS score.

Question 15

A security analyst is configuring a vulnerability scanner for a new deployment. The scanner must be able to authenticate to targets to perform deep configuration audits against CIS Benchmarks. Which type of scan should the analyst configure?

Accepted Answer

Credentialed scan. A credentialed scan supplies valid credentials (e.g., SSH keys, SMB accounts, or API tokens) to the scanner, allowing it to log into targets and inspect local configuration, registry settings, file permissions, and patch levels. This deep access is required to audit against CIS Benchmarks, which specify OS and application configuration hardening checks that cannot be assessed externally.

Answer

Unauthenticated scan

Answer

Passive scan

Answer

External scan