CS0-003 Vulnerability Management Practice Test 7 — 15 Questions

Question 1

A security team uses the Common Vulnerability Scoring System (CVSS) v3.1 to prioritize vulnerabilities. They find a vulnerability with a base score of 7.5 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. However, the asset is a public-facing web server with no backups. The team also checks the Exploit Prediction Scoring System (EPSS) and sees a score of 0.95 (95% probability of exploitation in the next 30 days). Which action should the team take first based on prioritizing by risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Expedite patch testing and deployment, and consider emergency change procedures. The high EPSS score indicates imminent exploitation, and the impact to availability is high. The CVSS impact reflects a potential denial of service, which is critical for a public-facing server. The lack of backups increases the risk of data loss or extended downtime. Therefore, immediate patching is the priority.

Answer

Apply the patch within the next 30 days as part of routine maintenance

Answer

Implement a network-based intrusion prevention system signature to block exploitation attempts

Answer

Deploy the patch immediately in the production environment without testing

Question 2

Which of the following best describes the purpose of the CISA Known Exploited Vulnerabilities (KEV) catalog in vulnerability management?

Accepted Answer

It lists vulnerabilities that are known to have been exploited in the wild. The KEV catalog is a list of vulnerabilities that have been actively exploited in the wild, published by CISA to help organizations prioritize patching.

Answer

It provides a framework for conducting penetration tests

Answer

It provides a scoring system for vulnerability severity

Answer

It offers a database of configuration baselines for operating systems

Question 3

A security analyst is reviewing a vulnerability scan report and notices that a plugin output indicates a potential misconfiguration in a web server that allows directory listing. The analyst wants to verify this finding manually. Which of the following tools would be most appropriate to confirm the vulnerability?

Accepted Answer

Burp Suite. Burp Suite is a web application security testing tool that can be used to manually verify web vulnerabilities like directory listing by intercepting and modifying requests.

Answer

Metasploit

Answer

Wireshark

Answer

Nmap

Question 4

During a vulnerability assessment of a Kubernetes cluster, a security analyst finds that a container is running with privileged mode enabled and has a hostPath mount that grants write access to the host's /var/log directory. Which of the following is the most significant security risk associated with this configuration?

Accepted Answer

Potential for container escape and host node compromise. Privileged containers combined with hostPath mounts can allow container escape, enabling an attacker to gain root access on the host node.

Answer

Data leakage through unrestricted storage access

Answer

Excessive network permissions allowing lateral movement

Answer

Increased attack surface due to unnecessary services running in the container

Question 5

An organization is implementing a patch management process for servers. Which of the following is a crucial step that should be performed before deploying patches to production servers?

Accepted Answer

Test the patch in a staging environment that closely mirrors production. Testing patches in a staging environment that mirrors production helps identify issues that could cause outages or incompatibilities.

Answer

Immediately apply the patch to all systems to minimize exposure

Answer

Review the CVSS score to decide if the patch is necessary

Answer

Verify patch compliance by checking the vendor's advisory

Question 6

A security analyst is reviewing a compliance scan report for a DoD environment that uses Security Technical Implementation Guides (STIGs). The report indicates several failures. Which TWO of the following are likely STIG requirements for a Windows 10 system?

Accepted Answer

Enable Windows Defender Credential Guard. STIGs for Windows 10 require hardening measures such as enabling Windows Defender Credential Guard to help protect credentials from credential-theft attacks, and setting a minimum password length of at least 14 characters. Insecure settings—automatic logon with blank password, disabling audit logs, and enabling SMBv1—would violate STIG requirements.

Answer

Allow automatic logon with empty password

Answer

Disable audit log generation for failed logins

Answer

Enable SMBv1 protocol for compatibility

Question 7

A security analyst is reviewing a vulnerability scan report and notices a critical vulnerability with a CVSS v3.1 base score of 9.8. The vector string is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which of the following best describes the attack vector and the scope impact?

Accepted Answer

Attack vector: Network; Scope: Unchanged. The CVSS vector AV:N indicates a network attack vector, meaning the vulnerability can be exploited remotely over a network. S:U indicates an unchanged scope, meaning the exploitation cannot affect resources beyond the security authority of the vulnerable component.

Answer

Attack vector: Network; Scope: Changed

Answer

Attack vector: Local; Scope: Changed

Answer

Attack vector: Adjacent; Scope: Unchanged

Question 8

A security analyst is prioritizing vulnerabilities for remediation. The analyst has identified several vulnerabilities with CVSS scores, but wants to incorporate additional context to ensure the most critical vulnerabilities are addressed first. Which TWO factors should the analyst consider beyond the CVSS base score? (Choose two.)

Accepted Answer

Exploit Prediction Scoring System (EPSS). EPSS provides a probability of exploitation based on real-world data, and KEV is a catalog of known exploited vulnerabilities from CISA. Both give additional context beyond CVSS. While the number of affected assets and vendor patch availability are also useful, EPSS and KEV specifically indicate real-world exploitation likelihood and are commonly used together for vulnerability prioritization.

Answer

Number of affected assets

Answer

Vulnerability publication date

Answer

Vendor patch availability

Question 9

An organization is implementing a patch management process. Which of the following is the BEST practice before deploying patches to production systems?

Accepted Answer

Test patches in a staging environment that mirrors production. Testing patches in a staging environment that mirrors production helps identify potential conflicts or issues before deployment, reducing the risk of disruption.

Answer

Disable automatic updates and deploy patches manually without testing

Answer

Immediately apply all patches to production to minimize exposure time

Answer

Only apply patches that have a CVSS score of 9.0 or higher

Question 10

A security analyst is prioritizing vulnerabilities for a critical internet-facing application server. The analyst has CVSS scores, EPSS scores, and access to the CISA KEV catalog. Which TWO factors should the analyst consider as the most important for determining remediation priority? (Select TWO)

Accepted Answer

Asset criticality and business context. Asset criticality and business context are crucial because the server is critical and internet-facing. KEV indicates known exploitation, which is also important. However, the question asks for two. The best two are asset criticality (since it's critical) and known exploitation (KEV). CVSS alone doesn't account for exploitability context.

Answer

CVSS base score

Answer

Number of plugins detecting the vulnerability

Answer

EPSS score

Question 11

A security team is implementing container security scanning in their CI/CD pipeline. They want to scan container images for vulnerabilities and Kubernetes misconfigurations. Which THREE tools from the following list are best suited for this purpose? (Select THREE)

Accepted Answer

Trivy. Trivy, Clair, and Snyk are all container image scanning tools. OpenSCAP is for compliance scanning of hosts, not containers. Burp Suite is a web application DAST tool.

Answer

Burp Suite

Answer

OpenSCAP

Question 12

A security analyst is reviewing a vulnerability scan report and notices a plugin that identifies a critical vulnerability with a CVSS v3.1 base score of 9.8. The CVSS vector string is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which attack vector is indicated?

Accepted Answer

Network. AV:N indicates network attack vector, meaning the vulnerability can be exploited remotely over the network without any physical or local access.

Answer

Adjacent network

Answer

Local

Answer

Physical

Question 13

A vulnerability scanner reports a finding with a CVSS v3.1 base score of 7.5 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. What does this indicate about the vulnerability?

Accepted Answer

It has high impact on availability. The vector shows high impact to availability (A:H) and no impact to confidentiality or integrity, so the vulnerability primarily affects availability.

Answer

It has high impact on integrity

Answer

It requires authentication to exploit

Answer

It has high impact on confidentiality

Question 14

Which of the following is the BEST description of configuration drift?

Accepted Answer

The gradual deviation of a system's configuration from the intended baseline. Configuration drift refers to the gradual change in system configurations over time, causing deviations from the baseline or security standards.

Answer

A planned change to a system's configuration

Answer

The process of reverting a system to its baseline configuration

Answer

A vulnerability that is patched and then reappears

Question 15

A vulnerability management team is evaluating whether to apply a patch immediately or implement a compensating control. The patch is for a vulnerability in a legacy system that cannot be taken offline during business hours. The compensating control would involve restricting network access to the system. Which decision is MOST appropriate?

Accepted Answer

Implement a compensating control and schedule patching during a maintenance window. If the system cannot be patched immediately, implementing a compensating control (network restriction) reduces risk while waiting for a maintenance window.

Answer

Ignore the vulnerability since it affects a legacy system

Answer

Remove the system from the network

Answer

Apply the patch immediately despite the outage risk