CS0-003 Vulnerability Management Practice Test 8 — 15 Questions

Question 1

During a vulnerability scan, a security analyst identifies a critical vulnerability with a CVSS v3.1 base score of 9.8. The attack vector is network, attack complexity is low, privileges required are none, user interaction is none, and the impact to confidentiality, integrity, and availability is high. Which CVSS vector string represents this vulnerability?

Accepted Answer

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVSS v3.1 vector string follows the format CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H for a network-attack vector, low complexity, no privileges, no user interaction, unchanged scope, and high impact on all three CIA metrics.

Answer

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Answer

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Answer

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Question 2

A security analyst is reviewing the results of a vulnerability scan and notices that several vulnerabilities have high CVSS scores but low EPSS scores. The analyst also cross-references the CISA Known Exploited Vulnerabilities (KEV) catalog and finds that none of these vulnerabilities are listed. Which approach should the analyst take when prioritizing remediation?

Accepted Answer

Prioritize based on EPSS scores and KEV status, but also consider business context.. EPSS predicts the likelihood of exploitation, and KEV lists vulnerabilities known to be exploited in the wild. High CVSS but low EPSS and not in KEV suggests the vulnerability may be severe but unlikely to be exploited currently. However, business context such as asset criticality and exposure should be considered; if the asset is critical and exposed, remediation should still be prioritized despite low exploitation likelihood.

Answer

Remediate vulnerabilities with high CVSS scores only if they are internet-facing.

Answer

Remediate only vulnerabilities found in the KEV catalog.

Answer

Remediate all vulnerabilities with CVSS scores above 9.0 immediately.

Question 3

A security team is implementing a patch management process for a large enterprise. They must ensure that patches are tested before deployment to production. The team has a staging environment that mirrors production. During patch testing, they discover that a critical security patch for a database server causes a performance degradation of 30% in a key application. What should the team do next?

Accepted Answer

Contact the vendor for a fix or workaround, and implement compensating controls in the meantime.. The patch is critical but causes performance issues. The best approach is to work with the vendor for a resolution or apply compensating controls until a fix is available. Applying the patch blindly may disrupt operations, while skipping it leaves the vulnerability unaddressed.

Answer

Skip the patch and rely on existing security controls.

Answer

Apply the patch to production immediately because it fixes a critical vulnerability.

Answer

Deploy the patch to a subset of production servers to test performance.

Question 4

An analyst is reviewing a Nessus scan report and sees a plugin result that indicates a web application is vulnerable to SQL injection. The plugin output includes the payload used and the database error message. Which OWASP Top 10 category does this vulnerability belong to?

Accepted Answer

A03:2021 – Injection. SQL injection is a classic injection flaw, which falls under OWASP Top 10 category 'A03:2021 – Injection' (or A1 in older versions).

Answer

A07:2021 – Identification and Authentication Failures

Answer

A09:2021 – Security Logging and Monitoring Failures

Answer

A01:2021 – Broken Access Control

Question 5

A company uses a configuration management tool to enforce CIS Benchmarks on its servers. The security team wants to apply Level 1 benchmarks to all servers to achieve a baseline security posture. Which of the following best describes the difference between CIS Level 1 and Level 2 benchmarks?

Accepted Answer

Level 1 benchmarks are basic security measures that do not impact system performance, while Level 2 benchmarks are more restrictive and may affect performance or usability.. CIS Level 1 benchmarks are intended to provide a clear security benefit without significantly impacting functionality or performance. Level 2 benchmarks provide more stringent security but may reduce functionality or require additional operational effort.

Answer

Level 1 benchmarks are for Linux systems, while Level 2 benchmarks are for Windows systems.

Answer

Level 1 benchmarks are for servers, while Level 2 benchmarks are for workstations.

Answer

Level 1 benchmarks are mandatory, while Level 2 benchmarks are optional.

Question 6

A security analyst is investigating a Kubernetes cluster and finds that a container is running with securityContext.privileged: true. The container also has a hostPath mount that allows writing to the host filesystem. Which of the following best describes the primary risk of this configuration?

Accepted Answer

The container can break out of the container environment and gain root access to the host node.. A privileged container with hostPath mount can escape the container and compromise the host. The container can access host resources, potentially allowing full host compromise.

Answer

The container can only read host files, but not modify them.

Answer

The container can only affect other containers in the same pod, not the host.

Answer

The container can be used to launch a denial-of-service attack on the Kubernetes API server.

Question 7

A security analyst is using OpenVAS to perform a vulnerability scan of an internal network. The scan completes and generates a report listing several vulnerabilities. What is the next step in the vulnerability lifecycle?

Accepted Answer

Prioritization. After discovery (scanning), the next step is prioritization of vulnerabilities based on risk, exploitability, and business impact.

Answer

Verification

Answer

Reporting

Answer

Remediation

Question 8

An organization is implementing a patch management process and wants to track compliance. They deploy patches to a test group of systems before rolling out to the entire environment. After patching the test group, they run a vulnerability scan and find that 95% of the vulnerabilities are resolved. What should the organization do next?

Accepted Answer

Verify the patch on test systems and then proceed with full deployment through change management.. After successful testing, the next step is to deploy the patch to the rest of the environment, following change management procedures.

Answer

Run another scan on the test group in a week to confirm persistence.

Answer

Immediately deploy the patch to all systems without further testing.

Answer

Skip full deployment and rely on the test group results.

Question 9

A security analyst is reviewing a DAST report from Burp Suite for a web application. The report indicates a potential Server-Side Request Forgery (SSRF) vulnerability in a feature that fetches URLs. Which of the following is the most effective mitigation?

Accepted Answer

Use a whitelist of allowed URLs and validate user input against it.. SSRF can be mitigated by validating and sanitizing user input, whitelisting allowed URLs, and blocking access to internal networks.

Answer

Disable the URL fetching feature entirely.

Answer

Increase memory limits on the server to prevent resource exhaustion.

Answer

Implement a Web Application Firewall (WAF) to block malicious requests.

Question 10

A cloud security team is using a container image scanning tool and finds a vulnerability in a base image used by many containers. The vulnerability is rated CVSS 7.5 and has a high EPSS score. However, rebuilding all containers with a patched base image will take significant time. What is the best immediate action?

Accepted Answer

Apply a hotfix or workaround to the affected package in running containers.. With high exploitability (EPSS), immediate action is needed. Applying a hotfix or workaround, such as updating the affected package in running containers, reduces risk while a full rebuild is planned.

Answer

Wait for the next scheduled rebuild cycle to patch the base image.

Answer

Increase network segmentation to limit exposure from the vulnerability.

Answer

Remove all containers using the vulnerable base image immediately.

Question 11

A security analyst is using Qualys to perform a vulnerability scan on a public-facing web server. The scan results show that the server is running an outdated version of Apache HTTP Server with multiple known vulnerabilities. The analyst checks the vendor security advisories and finds that a patch was released three months ago. However, the server is in a staging environment and not yet in production. What should the analyst recommend?

Accepted Answer

Patch the server immediately because it poses a risk to the staging network.. Even in staging, vulnerabilities should be patched to maintain security posture and to ensure that when the server moves to production, it is secure. Staging environments should mirror production security.

Answer

Only patch if the vulnerability is rated critical.

Answer

Do not patch because the server is not in production.

Answer

Wait until the server moves to production to patch.

Question 12

Which of the following tools is specifically designed for compliance scanning against security benchmarks such as CIS and STIG?

Accepted Answer

OpenSCAP. OpenSCAP is a compliance scanning tool that can assess systems against SCAP content, including CIS and STIG benchmarks.

Answer

OpenVAS

Answer

Nessus

Answer

Trivy

Question 13

A security analyst is prioritizing vulnerabilities discovered during a scan. Which TWO factors should the analyst consider as part of business context to determine remediation priority? (Select TWO.)

Accepted Answer

Asset exposure. Asset criticality (how important the asset is to the business) and exposure (whether the asset is internet-facing or accessible to attackers) are key business context factors.

Answer

CVSS base score

Answer

Patch availability

Answer

Exploit availability

Question 14

A security analyst is performing an API vulnerability test using OWASP ZAP. The analyst finds several issues. Which THREE of the following are common API vulnerabilities according to OWASP? (Select THREE.)

Accepted Answer

Broken Object Level Authorization. Broken object level authorization, excessive data exposure, and broken authentication are common API vulnerabilities listed in OWASP API Security Top 10.

Answer

SQL Injection

Answer

Cross-Site Scripting (XSS)

Question 15

A security team is deploying a new web application and wants to ensure it follows secure configuration practices. Which THREE of the following are recommended configuration settings according to CIS benchmarks for web servers? (Select THREE.)

Accepted Answer

Disable directory listing. Disabling directory listing, removing default accounts, and enforcing HTTPS are common secure configuration practices recommended by CIS benchmarks.

Answer

Use HTTP instead of HTTPS

Answer

Enable automatic directory browsing