CS0-003 Vulnerability Management Practice Test 8 — 15 Questions

Question 1

A security analyst is performing a vulnerability assessment and needs to identify potential misconfigurations in a Kubernetes cluster. Which TWO of the following are common Kubernetes misconfigurations that should be checked? (Select TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Privileged containers. Privileged containers and hostPath mounts are well-known security risks in Kubernetes. The other options are not typical misconfigurations.

Answer

Using network policies

Answer

Running containers as non-root user

Answer

Using ConfigMaps for non-sensitive data

Question 2

A security analyst is reviewing the output of a vulnerability scanner that uses CVSS v3.1. The analyst wants to understand the impact metrics. Which THREE of the following are impact metrics in the CVSS v3.1 base score? (Select THREE.)

Accepted Answer

Confidentiality (C). CVSS v3.1 base score includes three impact metrics: Confidentiality (C), Integrity (I), and Availability (A). Attack Vector, Attack Complexity, Privileges Required, etc., are exploitability metrics.

Answer

Scope (S)

Answer

Attack Vector (AV)

Question 3

A security analyst is setting up a vulnerability management program and needs to select tools for container image scanning. Which THREE of the following are commonly used container image scanning tools? (Select THREE.)

Accepted Answer

Snyk. Trivy, Clair, and Snyk are well-known container image scanning tools. OpenVAS is a network vulnerability scanner, and Burp Suite is for web application testing.

Answer

OpenVAS

Answer

Burp Suite

Question 4

A security analyst reviews a Nessus scan result for a web server. The plugin output indicates a critical vulnerability with CVSS v3.1 base score 9.8. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which of the following best describes the attack complexity?

Accepted Answer

Low. In the CVSS vector, AC:L means Attack Complexity is Low, indicating no special conditions are required for exploitation.

Answer

Critical

Answer

Medium

Answer

High

Question 5

An organization uses CIS Benchmarks to secure its Linux servers. The security team applies Level 1 benchmarks. Which of the following best describes Level 1 CIS benchmarks?

Accepted Answer

Basic security configurations with minimal operational impact. CIS Level 1 benchmarks are basic security configurations that cause minimal disruption to business operations. Level 2 is more restrictive and may impact functionality.

Answer

Advanced security settings that may reduce functionality

Answer

Required for all internet-facing systems

Answer

Only applicable to DoD environments

Question 6

A security analyst is using Burp Suite to test a web application for vulnerabilities. Which TWO of the following are common web application vulnerabilities that can be detected using Burp Suite? (Select TWO)

Accepted Answer

Cross-site scripting (XSS). Burp Suite can detect SQL injection and XSS through its scanner and manual testing tools. Buffer overflow and race conditions are typically not web application vulnerabilities detected by web proxies. Insecure deserialization can be detected but is less common than SQLi and XSS.

Answer

Buffer overflow

Answer

Insecure deserialization

Answer

Race condition

Question 7

A vulnerability management analyst is prioritizing vulnerabilities for remediation. The analyst has the following information for three vulnerabilities: CVE-2023-1: CVSS 9.8, EPSS 0.9, asset criticality high; CVE-2023-2: CVSS 7.5, EPSS 0.01, asset criticality low; CVE-2023-3: CVSS 5.0, EPSS 0.8, asset criticality medium. According to best practices, which THREE factors should the analyst consider when prioritizing? (Select THREE)

Accepted Answer

CVSS score. Prioritization should consider severity (CVSS), likelihood of exploitation (EPSS), and asset criticality. KEV is not mentioned in the data. Patch complexity and vendor reputation are secondary considerations but not primary factors in this context.

Answer

CVE publication date

Answer

Number of vendors affected

Question 8

An organization is implementing security hardening for Kubernetes clusters. Which THREE of the following are common Kubernetes misconfigurations that should be addressed? (Select THREE)

Accepted Answer

Using hostPath mounts without restrictions. Privileged containers, hostPath mounts, and overly permissive RBAC are common Kubernetes security issues. Using namespaces is good practice, not a misconfiguration. Network policies are recommended for segmentation.

Answer

Using namespaces to isolate workloads

Answer

Implementing network policies

Question 9

A security team discovers a critical vulnerability in a widely used software component. The vulnerability has a CVSS score of 9.0, but there is no known exploit or patch available yet. However, the software vendor has released a workaround. According to the vulnerability management lifecycle, which action should the team prioritize first?

Accepted Answer

Apply the workaround as a compensating control. Since no patch is available, the team should apply compensating controls to mitigate the risk. Remediation typically involves patching, but if not possible, compensating controls are the next best step.

Answer

Wait for the vendor to release a patch before taking any action

Answer

Remove the affected component from all systems immediately

Answer

Increase monitoring of the affected systems but take no other action

Question 10

A security analyst is evaluating a vulnerability with CVSS v3.1 base score: AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N. Which of the following best describes the scope and impact of this vulnerability?

Accepted Answer

Scope is changed, high impact on confidentiality only. The scope is Changed (S:C), meaning the vulnerable component impacts resources beyond its security scope. The impact is High on confidentiality (C:H), but none on integrity or availability.

Answer

Scope is unchanged, high impact on confidentiality only

Answer

Scope is changed, high impact on integrity only

Answer

Scope is unchanged, high impact on confidentiality and integrity

Question 11

A security analyst is reviewing the results of a web application vulnerability scan and needs to identify the vulnerabilities that are part of the OWASP Top 10 (2021) category 'Injection'. Which THREE of the following vulnerabilities fall under this category? (Select THREE.)

Accepted Answer

SQL injection. SQL injection, Cross-Site Scripting (XSS), and OS command injection are all types of injection flaws. XXE is also injection, but it is often listed separately; however, in OWASP Top 10 2021, Injection includes XSS, SQL injection, etc. Broken access control is a separate category.

Answer

Broken Access Control

Answer

Security Misconfiguration

Question 12

A vulnerability management team is prioritizing vulnerabilities for remediation. They have a list of vulnerabilities with different characteristics. According to best practices, which TWO factors should be considered when prioritizing vulnerabilities? (Select TWO.)

Accepted Answer

The asset's criticality to the business. Asset criticality (business context) and the presence of known exploits (e.g., KEV) are key prioritization factors. CVSS base score is a factor but not as dynamic. Patch availability is important but secondary to exploitability and business impact.

Answer

The CVSS base score

Answer

The availability of a patch

Answer

The number of open ports on the asset

Question 13

A vulnerability management team has identified a critical vulnerability with a CVSS score of 9.8. The vulnerability affects a public-facing web server that handles sensitive customer data. The team decides to apply a patch immediately without going through the normal patch testing cycle. What type of patching procedure is this?

Accepted Answer

Emergency patching. When a critical vulnerability is actively exploited or poses immediate risk, emergency patching procedures are used to expedite deployment without standard testing.

Answer

Rolling patch deployment

Answer

Patch compliance tracking

Answer

Standard patch management

Question 14

A security analyst is reviewing the output of a vulnerability scan and sees a finding for a web application that uses a known vulnerable version of Apache Struts. Which TWO of the following actions should the analyst prioritize?

Accepted Answer

Update Apache Struts to the latest patched version. Updating the component to a patched version is the primary remediation. If a patch is not immediately available, a WAF rule can provide temporary protection.

Answer

Remove the Apache Struts component entirely

Answer

Reboot the web server to clear memory

Answer

Disable the web application until further notice

Question 15

A security analyst is investigating a reported vulnerability in a web application. The team uses Burp Suite for DAST scanning. Which TWO of the following findings would be classified as injection vulnerabilities according to OWASP Top 10?

Accepted Answer

Stored XSS in the comment section. SQL injection and Stored XSS are both injection flaws. SQL injection is classic injection, and XSS is also a form of injection.

Answer

Use of a component with known vulnerabilities

Answer

Broken access control allowing privilege escalation

Answer

Security misconfiguration exposing directory listing