CS0-003 Vulnerability Management Practice Test 7 — 15 Questions

Question 1

During a web application security assessment using OWASP ZAP, a tester identifies that the application reflects user input in HTTP responses without proper encoding. Which OWASP Top 10 vulnerability category does this finding most likely belong to?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Injection. Reflected user input in responses without encoding is a classic sign of Cross-Site Scripting (XSS), which falls under injection in OWASP Top 10 (though XSS is specifically listed as a separate category in some versions, but in 2021 it is under injection).

Answer

Broken Access Control

Answer

Cryptographic Failures

Answer

Security Misconfiguration

Question 2

A security analyst is reviewing the results of a container image scan using Trivy. The scan reports a critical vulnerability in a base image layer. The development team states that the vulnerability is not exploitable because the affected library is not used in the application. According to vulnerability management best practices, what should the analyst do?

Accepted Answer

Request that the development team remove the unused library and rebuild the image.. Even if the library is not used, it is best practice to rebuild the image with a patched base image to eliminate the vulnerability and ensure compliance.

Answer

Accept the risk and close the finding.

Answer

Ignore the finding since it is not exploitable.

Answer

Apply a compensating control at the network level to block exploitation.

Question 3

Which of the following vulnerability scanning tools is open source and commonly used for network vulnerability assessment?

Accepted Answer

OpenVAS. OpenVAS is a well-known open-source vulnerability scanner.

Answer

Nessus

Answer

Qualys

Answer

Rapid7 InsightVM

Question 4

A security analyst is prioritizing vulnerabilities for remediation. One vulnerability has a CVSS v3.1 score of 7.5, an EPSS score of 0.02, and is not in the CISA KEV catalog. Another vulnerability has a CVSS score of 5.0, an EPSS score of 0.85, and is listed in the KEV catalog. Which vulnerability should be prioritized FIRST?

Accepted Answer

The vulnerability with CVSS 5.0. EPSS and KEV catalog provide real-world exploit intelligence. The vulnerability with high EPSS and KEV is more likely to be exploited, so it should be prioritized despite lower CVSS.

Answer

The vulnerability with CVSS 7.5

Answer

Both should be prioritized equally

Answer

Neither should be prioritized until a full risk assessment is done

Question 5

An organization uses OpenSCAP to perform compliance scanning against STIGs for DoD environments. A scan reveals that several systems are non-compliant with STIG ID: V-XXXXX requiring 'The system must disable the guest account.' The configuration drift detection tool shows that the guest account was re-enabled after a recent patch. What is the MOST effective course of action?

Accepted Answer

Update the system baseline to enforce the guest account disabled state via Group Policy.. Configuration drift indicates that patches or changes are reverting settings. The most effective action is to update the baseline configuration management tool (e.g., Group Policy) to enforce the setting automatically.

Answer

Apply an exception to the STIG requirement for these systems.

Answer

Re-run the OpenSCAP scan after the next patch cycle.

Answer

Manually disable the guest account on each non-compliant system.

Question 6

A web application security tester uses Burp Suite to test an API endpoint. The tester sends a request with a modified HTTP method and discovers that the API accepts DELETE requests on an endpoint that should only allow GET. This is an example of which OWASP Top 10 vulnerability?

Accepted Answer

Broken Access Control. Improper handling of HTTP methods can lead to broken access control, allowing unauthorized actions.

Answer

Injection

Answer

Security Misconfiguration

Answer

Server-Side Request Forgery (SSRF)

Question 7

Which metric in the CVSS v3.1 base score indicates the level of access an attacker needs to exploit a vulnerability?

Accepted Answer

Privileges Required (PR). Privileges Required (PR) indicates the level of privileges an attacker must have before successfully exploiting the vulnerability.

Answer

Attack Vector (AV)

Answer

Attack Complexity (AC)

Answer

User Interaction (UI)

Question 8

A company uses Lynis for compliance scanning on Linux servers. During a scan, Lynis reports that the system has world-writable files in critical directories. Which CIS Benchmark recommendation does this finding relate to?

Accepted Answer

Ensure no world-writable files exist. CIS Benchmarks include recommendations to restrict file permissions, such as ensuring no world-writable files exist in system directories.

Answer

Ensure system is configured to forward logs to a central server

Answer

Ensure permissions on /etc/shadow are configured

Answer

Ensure separate partition exists for /tmp

Question 9

A security analyst is evaluating a Kubernetes cluster for misconfigurations. Which TWO of the following are common Kubernetes misconfigurations that increase security risk? (Select the two best answers.)

Accepted Answer

Using hostPath mounts. Option B (Using hostPath mounts) is correct because a hostPath volume mounts a file or directory directly from the node's filesystem into the pod, allowing a compromised container to read or write sensitive node paths such as /etc, /var/run/docker.sock, or kubelet credentials, which can lead to node takeover or cluster compromise. Option C (Using privileged containers) is correct because a privileged container runs with essentially all Linux capabilities and full access to host devices and kernel interfaces (equivalent to --privileged), disabling isolation and enabling container escape and host compromise. Option A is not a misconfiguration but a security best practice, since running as non-root reduces privilege. Option D is not a misconfiguration because enabling RBAC is a recommended access-control hardening measure. Option E is not a misconfiguration because network policies that restrict pod traffic reduce lateral movement and are a security best practice.

Answer

Running containers as non-root user

Answer

Enabling Role-Based Access Control (RBAC)

Answer

Implementing network policies to restrict traffic

Question 10

An organization is implementing a patch management process. Which THREE of the following are essential steps that should be included before deploying patches to production systems? (Select the three best answers.)

Accepted Answer

Testing patches in a staging environment. Option A (Testing patches in a staging environment) is correct because a staging environment mirrors production and allows you to validate that patches install cleanly and don't break functionality before touching live systems. Option B (Reviewing vendor security advisories for patch details) is correct because advisories provide the CVE identifiers, severity ratings, affected versions, and known issues that let you prioritize and understand each patch before deployment. Option C (Performing regression testing on applications) is correct because patches can alter shared libraries, dependencies, or OS behavior, so regression testing confirms existing application functionality still works after patching. Option D is wrong because deploying patches simultaneously to all production systems removes any rollback safety net and can cause a widespread outage if the patch is faulty. Option E is wrong because disabling security controls exposes systems to attack and is never a legitimate patch-management step.

Answer

Deploying patches directly to all production systems simultaneously

Answer

Disabling all security controls to avoid conflicts

Question 11

A security analyst is using OpenVAS to scan a network. The scan identifies several vulnerabilities. Which TWO of the following are valid components of a CVSS v3.1 base score? (Select the two correct answers.)

Accepted Answer

Scope (S). Scope (S) is a valid CVSS v3.1 base metric that indicates whether a vulnerability can affect resources beyond the security scope of the vulnerable component, with values Unchanged (U) or Changed (C). Attack Vector (AV) is also a valid base metric describing the context in which the vulnerability is exploitable, with values Network (N), Adjacent (A), Local (L), or Physical (P). Both belong to the Base metric group, which also includes Attack Complexity (AC), Privileges Required (PR), User Interaction (UI), Confidentiality (C), Integrity (I), and Availability (A). Exploitability (E), Confidence (C), and Remediation Level (RL) are not base metrics: E and RL are Temporal metrics in CVSS v3.1, and Confidence is a metric from the older CVSS v2 environmental scoring, not part of CVSS v3.1 base scoring.

Answer

Exploitability (E)

Answer

Confidence (C)

Answer

Remediation Level (RL)

Question 12

A security analyst reviews a vulnerability scan report and identifies a critical vulnerability with a CVSS v3.1 base score of 9.8. The attack vector is 'Network', attack complexity is 'Low', privileges required is 'None', user interaction is 'None', scope is 'Unchanged', and all three CIA impacts are 'High'. Which additional factor should the analyst prioritize when deciding whether to apply a patch or a compensating control?

Accepted Answer

The EPSS score for the vulnerability. The EPSS score estimates the likelihood of exploitation in the wild, which helps prioritize remediation. CVSS alone does not indicate active exploitation.

Answer

The number of affected hosts

Answer

The OS type of the affected system

Answer

The vendor's patch release date

Question 13

A security analyst is reviewing a vulnerability scan report that includes a plugin output with the following CVSS v3.1 vector: AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H. Which of the following best describes the characteristics of this vulnerability?

Accepted Answer

Requires local access, high attack complexity, high privileges, and user interaction. The vector indicates local attack vector, high complexity, high privileges required, user interaction required, changed scope, and high impact on all three CIA metrics. This suggests a local privilege escalation vulnerability.

Answer

Easily exploitable by an unauthenticated remote attacker

Answer

Requires physical access to exploit

Answer

Remotely exploitable with low complexity

Question 14

A company is implementing a patch management process. Which of the following steps should be performed FIRST after a vendor releases a security patch for a critical vulnerability?

Accepted Answer

Test the patch in a staging environment that mirrors production. Patches should be tested in a staging environment to ensure they do not break critical business functions before deployment.

Answer

Schedule the patch for the next maintenance window

Answer

Deploy the patch to all production servers immediately

Answer

Create a patch compliance report

Question 15

A security analyst is configuring a compliance scan for a Linux server using CIS Benchmarks. The analyst must ensure the server meets Level 1 benchmarks. Which of the following is a characteristic of CIS Level 1 benchmarks?

Accepted Answer

They are practical and prudent, with a low impact on business functionality. Level 1 benchmarks are foundational and designed to have minimal impact on business operations while improving security.

Answer

They are only applicable to cloud environments

Answer

They provide specific STIG requirements for DoD systems

Answer

They are intended for high-security environments and may impact performance