CS0-003 Vulnerability Management Practice Test 7 — 15 Questions

Question 1

A security analyst reviews a vulnerability scan report and identifies a critical vulnerability with a CVSS v3.1 base score of 9.8. The attack vector is 'Network', attack complexity is 'Low', privileges required is 'None', user interaction is 'None', scope is 'Unchanged', and all three CIA impacts are 'High'. Which additional factor should the analyst prioritize when deciding whether to apply a patch or a compensating control?

Accepted Answer

The EPSS score for the vulnerability. The EPSS score estimates the likelihood of exploitation in the wild, which helps prioritize remediation. CVSS alone does not indicate active exploitation.

Answer

The number of affected hosts

Answer

The OS type of the affected system

Answer

The vendor's patch release date

Question 2

During a vulnerability assessment, a security analyst uses Nessus to scan a network. Which type of scan is most appropriate to identify live hosts and open ports without causing significant disruption?

Accepted Answer

TCP SYN scan. A TCP SYN scan is stealthier and less intrusive than a full connect scan, making it suitable for initial discovery.

Answer

Full connect scan

Answer

UDP scan

Answer

Ping sweep

Question 3

A security analyst is reviewing a vulnerability scan report that includes a plugin output with the following CVSS v3.1 vector: AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H. Which of the following best describes the characteristics of this vulnerability?

Accepted Answer

Requires local access, high attack complexity, high privileges, and user interaction. The vector indicates local attack vector, high complexity, high privileges required, user interaction required, changed scope, and high impact on all three CIA metrics. This suggests a local privilege escalation vulnerability.

Answer

Easily exploitable by an unauthenticated remote attacker

Answer

Requires physical access to exploit

Answer

Remotely exploitable with low complexity

Question 4

A company is implementing a patch management process. Which of the following steps should be performed FIRST after a vendor releases a security patch for a critical vulnerability?

Accepted Answer

Test the patch in a staging environment that mirrors production. Patches should be tested in a staging environment to ensure they do not break critical business functions before deployment.

Answer

Schedule the patch for the next maintenance window

Answer

Deploy the patch to all production servers immediately

Answer

Create a patch compliance report

Question 5

A security analyst is configuring a compliance scan for a Linux server using CIS Benchmarks. The analyst must ensure the server meets Level 1 benchmarks. Which of the following is a characteristic of CIS Level 1 benchmarks?

Accepted Answer

They are practical and prudent, with a low impact on business functionality. Level 1 benchmarks are foundational and designed to have minimal impact on business operations while improving security.

Answer

They are only applicable to cloud environments

Answer

They provide specific STIG requirements for DoD systems

Answer

They are intended for high-security environments and may impact performance

Question 6

A security analyst is evaluating a containerized application for vulnerabilities. The analyst runs Trivy on the container image and finds several high-severity vulnerabilities in the base image. Which of the following is the most effective remediation strategy?

Accepted Answer

Rebuild the image using a patched base image and redeploy. Rebuilding the container image with a patched base image addresses the root cause by eliminating vulnerable components.

Answer

Use a runtime security tool to monitor the container

Answer

Apply a host-based firewall to block exploitation attempts

Answer

Disable the container until a patch is available

Question 7

An organization wants to prioritize vulnerabilities based on the likelihood of exploitation. Which of the following sources provides a data-driven probability score for exploitation?

Accepted Answer

EPSS. EPSS uses real-world data to predict the probability of exploitation, aiding in prioritization.

Answer

CVSS v3.1

Answer

CIS Benchmarks

Answer

OWASP Top 10

Question 8

A security analyst is using a DAST tool to test a web application. Which of the following vulnerabilities would the tool most likely identify?

Accepted Answer

SQL injection. DAST tools interact with the running application and can detect vulnerabilities like SQL injection by sending malicious inputs and observing responses.

Answer

Hardcoded credentials in source code

Answer

Outdated library versions

Answer

Insecure cryptographic algorithms in configuration

Question 9

An organization uses OpenSCAP to perform compliance scanning. The scan results indicate that a system fails to meet a STIG requirement. Which of the following best describes the purpose of STIGs?

Accepted Answer

They are developed by the DoD to secure its information systems. STIGs are detailed security configuration guides for DoD systems, providing hardening requirements.

Answer

They are used solely for web application security

Answer

They are vulnerability scoring standards

Answer

They are industry-standard benchmarks for cloud security

Question 10

A security analyst discovers a critical vulnerability in a web application that allows an attacker to trigger server-side requests from the application server. Which OWASP Top 10 category does this vulnerability belong to?

Accepted Answer

Server-Side Request Forgery (SSRF). Server-Side Request Forgery (SSRF) is a distinct category in OWASP Top 10 (A10:2021).

Answer

Broken Access Control

Answer

Security Misconfiguration

Answer

Injection

Question 11

A security analyst is reviewing a vulnerability scan report and sees a plugin with a CVSS v3.1 base score of 7.5. The attack vector is 'Network', attack complexity is 'Low', privileges required is 'None', user interaction is 'None', scope is 'Unchanged', and the confidentiality impact is 'High', but integrity and availability impacts are 'None'. This vulnerability is best described as:

Accepted Answer

An information disclosure vulnerability. The vector indicates a remote, easily exploitable vulnerability that only affects confidentiality (e.g., information disclosure).

Answer

A remote code execution vulnerability

Answer

A denial of service vulnerability

Answer

A privilege escalation vulnerability

Question 12

A security analyst is using a container image scanner to identify vulnerabilities in a Kubernetes deployment. Which of the following tools is specifically designed for container image scanning?

Accepted Answer

Trivy. Trivy is a popular open-source tool for scanning container images for vulnerabilities.

Answer

OpenVAS

Answer

Nessus

Answer

Burp Suite

Question 13

A security analyst is conducting a vulnerability assessment of a Kubernetes cluster. Which TWO of the following are common misconfigurations that could lead to security risks? (Select TWO.)

Accepted Answer

Running containers in privileged mode. Privileged containers and hostPath mounts are common Kubernetes misconfigurations that can lead to container breakout and host access.

Answer

Setting resource limits on containers

Answer

Configuring network policies to restrict traffic

Answer

Using read-only root filesystems

Question 14

A security analyst is prioritizing vulnerabilities for remediation. Which THREE factors from the CISA Known Exploited Vulnerabilities (KEV) catalog should the analyst consider? (Select THREE.)

Accepted Answer

Date the vulnerability was added to the catalog. The KEV catalog lists vulnerabilities known to be exploited in the wild, including the date added, vendor name, and a brief description.

Answer

EPSS probability score

Answer

CVSS base score

Question 15

A security analyst is performing an API vulnerability test. Which THREE of the following are common API vulnerabilities according to OWASP? (Select THREE.)

Accepted Answer

Excessive Data Exposure. Broken object level authorization, excessive data exposure, and mass assignment are common API vulnerabilities per OWASP API Security Top 10.

Answer

SQL injection in the API endpoint

Answer

Cross-Site Request Forgery (CSRF)