CS0-003 Vulnerability Management Practice Test 8 — 15 Questions

Question 1

A security analyst is evaluating a containerized application for vulnerabilities. The analyst runs Trivy on the container image and finds several high-severity vulnerabilities in the base image. Which of the following is the most effective remediation strategy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Rebuild the image using a patched base image and redeploy. Rebuilding the container image with a patched base image addresses the root cause by eliminating vulnerable components.

Answer

Use a runtime security tool to monitor the container

Answer

Apply a host-based firewall to block exploitation attempts

Answer

Disable the container until a patch is available

Question 2

An organization wants to prioritize vulnerabilities based on the likelihood of exploitation. Which of the following sources provides a data-driven probability score for exploitation?

Accepted Answer

EPSS. EPSS uses real-world data to predict the probability of exploitation, aiding in prioritization.

Answer

CVSS v3.1

Answer

CIS Benchmarks

Answer

OWASP Top 10

Question 3

A security analyst is using a DAST tool to test a web application. Which of the following vulnerabilities would the tool most likely identify?

Accepted Answer

SQL injection. DAST tools interact with the running application and can detect vulnerabilities like SQL injection by sending malicious inputs and observing responses.

Answer

Hardcoded credentials in source code

Answer

Outdated library versions

Answer

Insecure cryptographic algorithms in configuration

Question 4

An organization uses OpenSCAP to perform compliance scanning. The scan results indicate that a system fails to meet a STIG requirement. Which of the following best describes the purpose of STIGs?

Accepted Answer

They are developed by the DoD to secure its information systems. STIGs (Security Technical Implementation Guides) are configuration standards developed by the Defense Information Systems Agency (DISA), a DoD agency, to provide mandatory technical security controls for hardening DoD information systems. They define specific settings, patch levels, and configuration baselines that systems must meet to be authorized for use within the DoD. OpenSCAP uses SCAP content (often derived from STIG benchmarks) to automatically assess compliance against these requirements, which is why a failed STIG check indicates a deviation from DoD-mandated configuration.

Answer

They are used solely for web application security

Answer

They are vulnerability scoring standards

Answer

They are industry-standard benchmarks for cloud security

Question 5

A security analyst discovers a critical vulnerability in a web application that allows an attacker to trigger server-side requests from the application server. Which OWASP Top 10 category does this vulnerability belong to?

Accepted Answer

Server-Side Request Forgery (SSRF). Server-Side Request Forgery (SSRF) is a distinct category in OWASP Top 10 (A10:2021).

Answer

Broken Access Control

Answer

Security Misconfiguration

Answer

Injection

Question 6

A security analyst is reviewing a vulnerability scan report and sees a plugin with a CVSS v3.1 base score of 7.5. The attack vector is 'Network', attack complexity is 'Low', privileges required is 'None', user interaction is 'None', scope is 'Unchanged', and the confidentiality impact is 'High', but integrity and availability impacts are 'None'. This vulnerability is best described as:

Accepted Answer

An information disclosure vulnerability. The vector indicates a remote, easily exploitable vulnerability that only affects confidentiality (e.g., information disclosure).

Answer

A remote code execution vulnerability

Answer

A denial of service vulnerability

Answer

A privilege escalation vulnerability

Question 7

A security analyst is using a container image scanner to identify vulnerabilities in a Kubernetes deployment. Which of the following tools is specifically designed for container image scanning?

Accepted Answer

Trivy. Trivy is a popular open-source tool for scanning container images for vulnerabilities.

Answer

OpenVAS

Answer

Nessus

Answer

Burp Suite

Question 8

A security analyst is conducting a vulnerability assessment of a Kubernetes cluster. Which TWO of the following are common misconfigurations that could lead to security risks? (Select TWO.)

Accepted Answer

Running containers in privileged mode. Option C is correct because running containers in privileged mode disables the container's isolation from the host, granting access to all Linux capabilities and devices (equivalent to --privileged), which allows a compromised container to escape and control the node. Option E is correct because hostPath mounts expose a file or directory from the node's filesystem directly into the pod, so a container can read or modify sensitive host paths such as /etc, /var/run/docker.sock, or /proc, enabling privilege escalation and node compromise. Options A and D are not misconfigurations but hardening measures: resource limits mitigate denial-of-service and noisy-neighbor risks, and read-only root filesystems prevent runtime tampering with container binaries. Option B is also a security control, not a risk, since Kubernetes NetworkPolicies restrict pod-to-pod traffic and enforce segmentation.

Answer

Setting resource limits on containers

Answer

Configuring network policies to restrict traffic

Answer

Using read-only root filesystems

Question 9

A security analyst is prioritizing vulnerabilities for remediation. Which THREE factors from the CISA Known Exploited Vulnerabilities (KEV) catalog should the analyst consider? (Select THREE.)

Accepted Answer

Date the vulnerability was added to the catalog. The CISA KEV catalog entry for each vulnerability includes the date it was added to the catalog (option B), which indicates how long the vulnerability has been known to be actively exploited and helps prioritize remediation urgency. It also lists the vulnerability name or CVE ID (option D), which uniquely identifies the specific flaw so the analyst can map it to affected systems and track remediation. The affected vendor or product (option E) is likewise a core KEV field, telling the analyst which technologies are at risk and whether they are present in the environment. EPSS probability score (option A) is not part of the KEV catalog; it comes from the separate EPSS model maintained by FIRST. CVSS base score (option C) is also not a KEV catalog field; it is published by NVD or the vendor and is not included in KEV entries.

Answer

EPSS probability score

Answer

CVSS base score

Question 10

During a vulnerability scan, a security analyst identifies a critical vulnerability with a CVSS v3.1 base score of 9.8. The attack vector is network, attack complexity is low, privileges required are none, user interaction is none, and the impact to confidentiality, integrity, and availability is high. Which CVSS vector string represents this vulnerability?

Accepted Answer

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H represents a vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high impact to confidentiality, integrity, and availability. This matches the description and yields a base score of 9.8 (Critical).

Answer

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Answer

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Answer

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Question 11

A security analyst is reviewing the results of a vulnerability scan and notices that several vulnerabilities have high CVSS scores but low EPSS scores. The analyst also cross-references the CISA Known Exploited Vulnerabilities (KEV) catalog and finds that none of these vulnerabilities are listed. Which approach should the analyst take when prioritizing remediation?

Accepted Answer

Prioritize based on EPSS scores and KEV status, but also consider business context.. EPSS predicts the likelihood of exploitation, and KEV lists vulnerabilities known to be exploited in the wild. High CVSS but low EPSS and not in KEV suggests the vulnerability may be severe but unlikely to be exploited currently. However, business context such as asset criticality and exposure should be considered; if the asset is critical and exposed, remediation should still be prioritized despite low exploitation likelihood.

Answer

Remediate vulnerabilities with high CVSS scores only if they are internet-facing.

Answer

Remediate only vulnerabilities found in the KEV catalog.

Answer

Remediate all vulnerabilities with CVSS scores above 9.0 immediately.

Question 12

A security team is implementing a patch management process for a large enterprise. They must ensure that patches are tested before deployment to production. The team has a staging environment that mirrors production. During patch testing, they discover that a critical security patch for a database server causes a performance degradation of 30% in a key application. What should the team do next?

Accepted Answer

Contact the vendor for a fix or workaround, and implement compensating controls in the meantime.. The patch is critical but causes performance issues. The best approach is to work with the vendor for a resolution or apply compensating controls until a fix is available. Applying the patch blindly may disrupt operations, while skipping it leaves the vulnerability unaddressed.

Answer

Skip the patch and rely on existing security controls.

Answer

Apply the patch to production immediately because it fixes a critical vulnerability.

Answer

Deploy the patch to a subset of production servers to test performance.

Question 13

An analyst is reviewing a Nessus scan report and sees a plugin result that indicates a web application is vulnerable to SQL injection. The plugin output includes the payload used and the database error message. Which OWASP Top 10 category does this vulnerability belong to?

Accepted Answer

A03:2021 – Injection. SQL injection is a classic injection flaw where untrusted input is interpreted as code by the database. In the OWASP Top 10 2021, SQL injection falls under A03:2021 – Injection, which encompasses SQL, NoSQL, OS command, ORM, and LDAP injection. The plugin output showing a payload and database error confirms injection.

Answer

A07:2021 – Identification and Authentication Failures

Answer

A09:2021 – Security Logging and Monitoring Failures

Answer

A01:2021 – Broken Access Control

Question 14

A company uses a configuration management tool to enforce CIS Benchmarks on its servers. The security team wants to apply Level 1 benchmarks to all servers to achieve a baseline security posture. Which of the following best describes the difference between CIS Level 1 and Level 2 benchmarks?

Accepted Answer

Level 1 benchmarks are basic security measures that do not impact system performance, while Level 2 benchmarks are more restrictive and may affect performance or usability.. CIS Benchmarks define Level 1 as essential, basic security settings that can be applied broadly with minimal impact on functionality or performance, making them suitable as a universal baseline. Level 2 settings are defense-in-depth measures intended for high-security environments; they are more restrictive and may degrade performance or break usability (e.g., disabling legacy protocols or enforcing strict password policies). The question's goal of a baseline posture maps directly to Level 1.

Answer

Level 1 benchmarks are for Linux systems, while Level 2 benchmarks are for Windows systems.

Answer

Level 1 benchmarks are for servers, while Level 2 benchmarks are for workstations.

Answer

Level 1 benchmarks are mandatory, while Level 2 benchmarks are optional.

Question 15

A security analyst is investigating a Kubernetes cluster and finds that a container is running with securityContext.privileged: true. The container also has a hostPath mount that allows writing to the host filesystem. Which of the following best describes the primary risk of this configuration?

Accepted Answer

The container can break out of the container environment and gain root access to the host node.. A privileged container with hostPath mount can escape the container and compromise the host. The container can access host resources, potentially allowing full host compromise.

Answer

The container can only read host files, but not modify them.

Answer

The container can only affect other containers in the same pod, not the host.

Answer

The container can be used to launch a denial-of-service attack on the Kubernetes API server.