CS0-003 Vulnerability Management Practice Test 6 — 15 Questions

Question 1

A security analyst is reviewing a vulnerability scan report and sees a plugin with a CVSS v3.1 base score of 7.5. The attack vector is 'Network', attack complexity is 'Low', privileges required is 'None', user interaction is 'None', scope is 'Unchanged', and the confidentiality impact is 'High', but integrity and availability impacts are 'None'. This vulnerability is best described as:

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An information disclosure vulnerability. The vector indicates a remote, easily exploitable vulnerability that only affects confidentiality (e.g., information disclosure).

Answer

A remote code execution vulnerability

Answer

A denial of service vulnerability

Answer

A privilege escalation vulnerability

Question 2

A security analyst is using a container image scanner to identify vulnerabilities in a Kubernetes deployment. Which of the following tools is specifically designed for container image scanning?

Accepted Answer

Trivy. Trivy is a popular open-source tool for scanning container images for vulnerabilities.

Answer

OpenVAS

Answer

Nessus

Answer

Burp Suite

Question 3

A security analyst is performing an API vulnerability test. Which THREE of the following are common API vulnerabilities according to OWASP? (Select THREE.)

Accepted Answer

SQL injection in the API endpoint. OWASP API Security Top 10 includes injection (including SQL injection), broken object level authorization, excessive data exposure, and mass assignment. The original explanation omits injection, making the marked answer set incomplete and the question ambiguous.

Answer

Cross-Site Request Forgery (CSRF)

Question 4

During a vulnerability scan, a security analyst identifies a critical vulnerability with a CVSS v3.1 base score of 9.8. The attack vector is network, attack complexity is low, privileges required are none, user interaction is none, and the impact to confidentiality, integrity, and availability is high. Which CVSS vector string represents this vulnerability?

Accepted Answer

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVSS v3.1 vector string follows the format CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H for a network-attack vector, low complexity, no privileges, no user interaction, unchanged scope, and high impact on all three CIA metrics.

Answer

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Answer

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Answer

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Question 5

A security analyst is reviewing the results of a vulnerability scan and notices that several vulnerabilities have high CVSS scores but low EPSS scores. The analyst also cross-references the CISA Known Exploited Vulnerabilities (KEV) catalog and finds that none of these vulnerabilities are listed. Which approach should the analyst take when prioritizing remediation?

Accepted Answer

Prioritize based on EPSS scores and KEV status, but also consider business context.. EPSS predicts the likelihood of exploitation, and KEV lists vulnerabilities known to be exploited in the wild. High CVSS but low EPSS and not in KEV suggests the vulnerability may be severe but unlikely to be exploited currently. However, business context such as asset criticality and exposure should be considered; if the asset is critical and exposed, remediation should still be prioritized despite low exploitation likelihood.

Answer

Remediate vulnerabilities with high CVSS scores only if they are internet-facing.

Answer

Remediate only vulnerabilities found in the KEV catalog.

Answer

Remediate all vulnerabilities with CVSS scores above 9.0 immediately.

Question 6

A security team is implementing a patch management process for a large enterprise. They must ensure that patches are tested before deployment to production. The team has a staging environment that mirrors production. During patch testing, they discover that a critical security patch for a database server causes a performance degradation of 30% in a key application. What should the team do next?

Accepted Answer

Contact the vendor for a fix or workaround, and implement compensating controls in the meantime.. The patch is critical but causes performance issues. The best approach is to work with the vendor for a resolution or apply compensating controls until a fix is available. Applying the patch blindly may disrupt operations, while skipping it leaves the vulnerability unaddressed.

Answer

Skip the patch and rely on existing security controls.

Answer

Apply the patch to production immediately because it fixes a critical vulnerability.

Answer

Deploy the patch to a subset of production servers to test performance.

Question 7

An analyst is reviewing a Nessus scan report and sees a plugin result that indicates a web application is vulnerable to SQL injection. The plugin output includes the payload used and the database error message. Which OWASP Top 10 category does this vulnerability belong to?

Accepted Answer

A03:2021 – Injection. SQL injection is a classic injection flaw, which falls under OWASP Top 10 category 'A03:2021 – Injection' (or A1 in older versions).

Answer

A07:2021 – Identification and Authentication Failures

Answer

A09:2021 – Security Logging and Monitoring Failures

Answer

A01:2021 – Broken Access Control

Question 8

A security analyst is investigating a Kubernetes cluster and finds that a container is running with securityContext.privileged: true. The container also has a hostPath mount that allows writing to the host filesystem. Which of the following best describes the primary risk of this configuration?

Accepted Answer

The container can break out of the container environment and gain root access to the host node.. A privileged container with hostPath mount can escape the container and compromise the host. The container can access host resources, potentially allowing full host compromise.

Answer

The container can only read host files, but not modify them.

Answer

The container can only affect other containers in the same pod, not the host.

Answer

The container can be used to launch a denial-of-service attack on the Kubernetes API server.

Question 9

A security analyst is using OpenVAS to perform a vulnerability scan of an internal network. The scan completes and generates a report listing several vulnerabilities. What is the next step in the vulnerability lifecycle?

Accepted Answer

Prioritization. After discovery (scanning), the next step is prioritization of vulnerabilities based on risk, exploitability, and business impact.

Answer

Verification

Answer

Reporting

Answer

Remediation

Question 10

An organization is implementing a patch management process and wants to track compliance. They deploy patches to a test group of systems before rolling out to the entire environment. After patching the test group, they run a vulnerability scan and find that 95% of the vulnerabilities are resolved. What should the organization do next?

Accepted Answer

Verify the patch on test systems and then proceed with full deployment through change management.. After successful testing, the next step is to deploy the patch to the rest of the environment, following change management procedures.

Answer

Run another scan on the test group in a week to confirm persistence.

Answer

Immediately deploy the patch to all systems without further testing.

Answer

Skip full deployment and rely on the test group results.

Question 11

A security analyst is reviewing a DAST report from Burp Suite for a web application. The report indicates a potential Server-Side Request Forgery (SSRF) vulnerability in a feature that fetches URLs. Which of the following is the most effective mitigation?

Accepted Answer

Use a whitelist of allowed URLs and validate user input against it.. SSRF can be mitigated by validating and sanitizing user input, whitelisting allowed URLs, and blocking access to internal networks.

Answer

Disable the URL fetching feature entirely.

Answer

Increase memory limits on the server to prevent resource exhaustion.

Answer

Implement a Web Application Firewall (WAF) to block malicious requests.

Question 12

A cloud security team is using a container image scanning tool and finds a vulnerability in a base image used by many containers. The vulnerability is rated CVSS 7.5 and has a high EPSS score. However, rebuilding all containers with a patched base image will take significant time. What is the best immediate action?

Accepted Answer

Apply a hotfix or workaround to the affected package in running containers.. With high exploitability (EPSS), immediate action is needed. Applying a hotfix or workaround, such as updating the affected package in running containers, reduces risk while a full rebuild is planned.

Answer

Wait for the next scheduled rebuild cycle to patch the base image.

Answer

Increase network segmentation to limit exposure from the vulnerability.

Answer

Remove all containers using the vulnerable base image immediately.

Question 13

A security analyst is using Qualys to perform a vulnerability scan on a public-facing web server. The scan results show that the server is running an outdated version of Apache HTTP Server with multiple known vulnerabilities. The analyst checks the vendor security advisories and finds that a patch was released three months ago. However, the server is in a staging environment and not yet in production. What should the analyst recommend?

Accepted Answer

Patch the server immediately because it poses a risk to the staging network.. Even in staging, vulnerabilities should be patched to maintain security posture and to ensure that when the server moves to production, it is secure. Staging environments should mirror production security.

Answer

Only patch if the vulnerability is rated critical.

Answer

Do not patch because the server is not in production.

Answer

Wait until the server moves to production to patch.

Question 14

Which of the following tools is specifically designed for compliance scanning against security benchmarks such as CIS and STIG?

Accepted Answer

OpenSCAP. OpenSCAP is a compliance scanning tool that can assess systems against SCAP content, including CIS and STIG benchmarks.

Answer

OpenVAS

Answer

Nessus

Answer

Trivy

Question 15

During a vulnerability assessment, a security analyst discovers a web application that is vulnerable to SQL injection. The application is a legacy system that cannot be easily patched. The analyst recommends implementing a web application firewall (WAF) rule to block malicious SQL patterns. Which type of control does this represent?

Accepted Answer

Compensating control. A compensating control is an alternative control that mitigates risk when the primary control (patch) cannot be applied.

Answer

Corrective control

Answer

Preventive control

Answer

Detective control