CS0-003 Vulnerability Management Practice Test 6 — 15 Questions

Question 1

During a vulnerability scan, a security analyst identifies a critical vulnerability with a CVSS v3.1 base score of 9.8. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which component of this vector indicates that the vulnerability can be exploited without any user interaction?

Accepted Answer

UI:N. The UI (User Interaction) metric in the CVSS vector is set to N (None), meaning no user action is required for exploitation.

Answer

AC:L

Answer

AV:N

Answer

PR:N

Question 2

A vulnerability management analyst is reviewing scan results from a recent Nessus scan. The analyst notices a plugin with the output: 'The remote host is missing a security patch for CVE-2023-1234. The patch was released by the vendor on 2023-05-01.' Which phase of the vulnerability lifecycle is the analyst currently performing?

Accepted Answer

Discovery. The analyst is reviewing scan results to identify vulnerabilities, which is the discovery phase of the vulnerability lifecycle.

Answer

Prioritization

Answer

Remediation

Answer

Verification

Question 3

An organization uses Qualys for vulnerability scanning. After a scan, the security team identifies a vulnerability with an EPSS score of 0.95 and that appears in the CISA KEV catalog. However, the affected asset is a non-critical development server with no internet access. According to the vulnerability lifecycle, what should be the analyst's NEXT action?

Accepted Answer

Document the finding and schedule remediation during the next regular maintenance window.. Despite high EPSS and KEV listing, the asset's low business context (non-critical, no internet access) reduces risk; the analyst should prioritize based on business context, likely scheduling remediation with lower urgency.

Answer

Apply a compensating control, such as a firewall rule blocking access to the server.

Answer

Escalate the vulnerability to management for emergency patching.

Answer

Immediately patch the server within 48 hours due to the high EPSS score.

Question 4

A security analyst is configuring a vulnerability scanner for a new deployment. The scanner must be able to authenticate to targets to perform deep configuration audits against CIS Benchmarks. Which type of scan should the analyst configure?

Accepted Answer

Credentialed scan. Authenticated scans use credentials to access the target and perform deep configuration checks, such as CIS Benchmark compliance.

Answer

Unauthenticated scan

Answer

Passive scan

Answer

External scan

Question 5

During a web application security assessment using OWASP ZAP, a tester identifies that the application reflects user input in HTTP responses without proper encoding. Which OWASP Top 10 vulnerability category does this finding most likely belong to?

Accepted Answer

Injection. Reflected user input in responses without encoding is a classic sign of Cross-Site Scripting (XSS), which falls under injection in OWASP Top 10 (though XSS is specifically listed as a separate category in some versions, but in 2021 it is under injection).

Answer

Broken Access Control

Answer

Cryptographic Failures

Answer

Security Misconfiguration

Question 6

A security analyst is reviewing the results of a container image scan using Trivy. The scan reports a critical vulnerability in a base image layer. The development team states that the vulnerability is not exploitable because the affected library is not used in the application. According to vulnerability management best practices, what should the analyst do?

Accepted Answer

Request that the development team remove the unused library and rebuild the image.. Even if the library is not used, it is best practice to rebuild the image with a patched base image to eliminate the vulnerability and ensure compliance.

Answer

Accept the risk and close the finding.

Answer

Ignore the finding since it is not exploitable.

Answer

Apply a compensating control at the network level to block exploitation.

Question 7

Which of the following vulnerability scanning tools is open source and commonly used for network vulnerability assessment?

Accepted Answer

OpenVAS. OpenVAS is a well-known open-source vulnerability scanner.

Answer

Nessus

Answer

Qualys

Answer

Rapid7 InsightVM

Question 8

A security analyst is prioritizing vulnerabilities for remediation. One vulnerability has a CVSS v3.1 score of 7.5, an EPSS score of 0.02, and is not in the CISA KEV catalog. Another vulnerability has a CVSS score of 5.0, an EPSS score of 0.85, and is listed in the KEV catalog. Which vulnerability should be prioritized FIRST?

Accepted Answer

The vulnerability with CVSS 5.0. EPSS and KEV catalog provide real-world exploit intelligence. The vulnerability with high EPSS and KEV is more likely to be exploited, so it should be prioritized despite lower CVSS.

Answer

The vulnerability with CVSS 7.5

Answer

Both should be prioritized equally

Answer

Neither should be prioritized until a full risk assessment is done

Question 9

An organization uses OpenSCAP to perform compliance scanning against STIGs for DoD environments. A scan reveals that several systems are non-compliant with STIG ID: V-XXXXX requiring 'The system must disable the guest account.' The configuration drift detection tool shows that the guest account was re-enabled after a recent patch. What is the MOST effective course of action?

Accepted Answer

Update the system baseline to enforce the guest account disabled state via Group Policy.. Configuration drift indicates that patches or changes are reverting settings. The most effective action is to update the baseline configuration management tool (e.g., Group Policy) to enforce the setting automatically.

Answer

Apply an exception to the STIG requirement for these systems.

Answer

Re-run the OpenSCAP scan after the next patch cycle.

Answer

Manually disable the guest account on each non-compliant system.

Question 10

A web application security tester uses Burp Suite to test an API endpoint. The tester sends a request with a modified HTTP method and discovers that the API accepts DELETE requests on an endpoint that should only allow GET. This is an example of which OWASP Top 10 vulnerability?

Accepted Answer

Broken Access Control. Improper handling of HTTP methods can lead to broken access control, allowing unauthorized actions.

Answer

Injection

Answer

Security Misconfiguration

Answer

Server-Side Request Forgery (SSRF)

Question 11

Which metric in the CVSS v3.1 base score indicates the level of access an attacker needs to exploit a vulnerability?

Accepted Answer

Privileges Required (PR). Privileges Required (PR) indicates the level of privileges an attacker must have before successfully exploiting the vulnerability.

Answer

Attack Vector (AV)

Answer

Attack Complexity (AC)

Answer

User Interaction (UI)

Question 12

A company uses Lynis for compliance scanning on Linux servers. During a scan, Lynis reports that the system has world-writable files in critical directories. Which CIS Benchmark recommendation does this finding relate to?

Accepted Answer

Ensure no world-writable files exist. CIS Benchmarks include recommendations to restrict file permissions, such as ensuring no world-writable files exist in system directories.

Answer

Ensure system is configured to forward logs to a central server

Answer

Ensure permissions on /etc/shadow are configured

Answer

Ensure separate partition exists for /tmp

Question 13

A security analyst is evaluating a Kubernetes cluster for misconfigurations. Which TWO of the following are common Kubernetes misconfigurations that increase security risk? (Select the two best answers.)

Accepted Answer

Using hostPath mounts. Privileged containers and hostPath mounts are known high-risk misconfigurations in Kubernetes.

Answer

Running containers as non-root user

Answer

Enabling Role-Based Access Control (RBAC)

Answer

Implementing network policies to restrict traffic

Question 14

An organization is implementing a patch management process. Which THREE of the following are essential steps that should be included before deploying patches to production systems? (Select the three best answers.)

Accepted Answer

Testing patches in a staging environment. Staging environment testing, regression testing, and vendor advisory review are key pre-deployment steps.

Answer

Deploying patches directly to all production systems simultaneously

Answer

Disabling all security controls to avoid conflicts

Question 15

A security analyst is using OpenVAS to scan a network. The scan identifies several vulnerabilities. Which TWO of the following are valid components of a CVSS v3.1 base score? (Select the two correct answers.)

Accepted Answer

Scope (S). Attack Vector and Scope are both part of the CVSS v3.1 base score.

Answer

Exploitability (E)

Answer

Confidence (C)

Answer

Remediation Level (RL)