CS0-003 Vulnerability Management Practice Test 9 — 15 Questions

Question 1

A security analyst is evaluating a Kubernetes cluster for misconfigurations. Which TWO of the following are common Kubernetes misconfigurations that increase security risk? (Select the two best answers.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Using hostPath mounts. Privileged containers and hostPath mounts are known high-risk misconfigurations in Kubernetes.

Answer

Running containers as non-root user

Answer

Enabling Role-Based Access Control (RBAC)

Answer

Implementing network policies to restrict traffic

Question 2

An organization is implementing a patch management process. Which THREE of the following are essential steps that should be included before deploying patches to production systems? (Select the three best answers.)

Accepted Answer

Testing patches in a staging environment. Staging environment testing, regression testing, and vendor advisory review are key pre-deployment steps.

Answer

Deploying patches directly to all production systems simultaneously

Answer

Disabling all security controls to avoid conflicts

Question 3

A security analyst is using OpenVAS to scan a network. The scan identifies several vulnerabilities. Which TWO of the following are valid components of a CVSS v3.1 base score? (Select the two correct answers.)

Accepted Answer

Scope (S). Attack Vector and Scope are both part of the CVSS v3.1 base score.

Answer

Exploitability (E)

Answer

Confidence (C)

Answer

Remediation Level (RL)

Question 4

A company is implementing a patch management process. Which of the following steps should be performed FIRST after a vendor releases a security patch for a critical vulnerability?

Accepted Answer

Test the patch in a staging environment that mirrors production. Patches should be tested in a staging environment to ensure they do not break critical business functions before deployment.

Answer

Schedule the patch for the next maintenance window

Answer

Deploy the patch to all production servers immediately

Answer

Create a patch compliance report

Question 5

A security analyst is conducting a vulnerability assessment of a Kubernetes cluster. Which TWO of the following are common misconfigurations that could lead to security risks? (Select TWO.)

Accepted Answer

Running containers in privileged mode. Privileged containers and hostPath mounts are common Kubernetes misconfigurations that can lead to container breakout and host access.

Answer

Setting resource limits on containers

Answer

Configuring network policies to restrict traffic

Answer

Using read-only root filesystems

Question 6

A security analyst is prioritizing vulnerabilities for remediation. Which THREE factors from the CISA Known Exploited Vulnerabilities (KEV) catalog should the analyst consider? (Select THREE.)

Accepted Answer

Date the vulnerability was added to the catalog. The KEV catalog lists vulnerabilities known to be exploited in the wild, including the date added, vendor name, and a brief description.

Answer

EPSS probability score

Answer

CVSS base score

Question 7

A company uses a configuration management tool to enforce CIS Benchmarks on its servers. The security team wants to apply Level 1 benchmarks to all servers to achieve a baseline security posture. Which of the following best describes the difference between CIS Level 1 and Level 2 benchmarks?

Accepted Answer

Level 1 benchmarks are basic security measures that do not impact system performance, while Level 2 benchmarks are more restrictive and may affect performance or usability.. CIS Level 1 benchmarks are intended to provide a clear security benefit without significantly impacting functionality or performance. Level 2 benchmarks provide more stringent security but may reduce functionality or require additional operational effort.

Answer

Level 1 benchmarks are for Linux systems, while Level 2 benchmarks are for Windows systems.

Answer

Level 1 benchmarks are for servers, while Level 2 benchmarks are for workstations.

Answer

Level 1 benchmarks are mandatory, while Level 2 benchmarks are optional.

Question 8

A security analyst is prioritizing vulnerabilities discovered during a scan. Which TWO factors should the analyst consider as part of business context to determine remediation priority? (Select TWO.)

Accepted Answer

Asset exposure. Asset criticality (how important the asset is to the business) and exposure (whether the asset is internet-facing or accessible to attackers) are key business context factors.

Answer

CVSS base score

Answer

Patch availability

Answer

Exploit availability

Question 9

A security analyst is performing an API vulnerability test using OWASP ZAP. The analyst finds several issues. Which THREE of the following are common API vulnerabilities according to OWASP? (Select THREE.)

Accepted Answer

Broken Object Level Authorization. Broken object level authorization, excessive data exposure, and broken authentication are common API vulnerabilities listed in OWASP API Security Top 10.

Answer

SQL Injection

Answer

Cross-Site Scripting (XSS)

Question 10

A security team is deploying a new web application and wants to ensure it follows secure configuration practices. Which THREE of the following are recommended configuration settings according to CIS benchmarks for web servers? (Select THREE.)

Accepted Answer

Disable directory listing. Disabling directory listing, removing default accounts, and enforcing HTTPS are common secure configuration practices recommended by CIS benchmarks.

Answer

Use HTTP instead of HTTPS

Answer

Enable automatic directory browsing

Question 11

A security analyst is reviewing a vulnerability scan report and sees a critical finding with a CVSS v3.1 base score of 9.8. The vector string is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which of the following best describes the attack vector component (AV:N)?

Accepted Answer

The attacker can exploit the vulnerability over a network from a remote system. AV:N means the vulnerability can be exploited over a network, such as the internet, without requiring physical or local access.

Answer

The attacker must be on the same physical network segment

Answer

The attacker requires local access to the target system

Answer

The attacker must be physically present at the device

Question 12

A security analyst is configuring a container scanning tool to identify vulnerabilities in Docker images before deployment. Which of the following tools is specifically designed for container image vulnerability scanning?

Accepted Answer

Trivy. Trivy is an open-source vulnerability scanner for container images, filesystems, and Git repositories.

Answer

Burp Suite

Answer

Nessus

Answer

OpenVAS

Question 13

A cybersecurity analyst is reviewing the configuration of a Linux server against CIS Benchmarks. The analyst notices that several settings deviate from the recommended baseline. Which TWO of the following are most likely to be considered Level 1 CIS Benchmark recommendations?

Accepted Answer

Set password expiration to 90 days. CIS Level 1 recommendations are basic security settings that do not cause significant operational impact. Setting password expiration and disabling root SSH login are common Level 1 items.

Answer

Remove all unnecessary packages and services

Answer

Enable mandatory access control (SELinux) in enforcing mode

Answer

Configure audit rules for file permission changes

Question 14

A security analyst is conducting a dynamic application security testing (DAST) scan of a REST API. The scanner reports a potential Server-Side Request Forgery (SSRF) vulnerability. The analyst needs to confirm the finding manually. Which TWO of the following techniques are most appropriate for validating SSRF?

Accepted Answer

Submit a payload that triggers the server to send a request to an attacker-controlled external server (e.g., Burp Collaborator). SSRF can be confirmed by making requests to internal resources (e.g., localhost) and observing responses, or by using an external collaborator service to detect out-of-band callbacks.

Answer

Inject malicious SQL queries into input fields to see if they are executed

Answer

Attempt to upload a malicious file to the server

Answer

Modify HTTP headers to test for cross-site scripting

Question 15

A security analyst is using a vulnerability scanner to identify missing patches on Windows servers. The scanner uses plugins that reference Common Vulnerabilities and Exposures (CVE) identifiers. Which THREE of the following are components of a CVSS v3.1 base score vector?

Accepted Answer

Attack Vector (AV). Attack Vector (AV), Privileges Required (PR), and Confidentiality (C) are all part of the CVSS v3.1 base metric group.

Answer

Remediation Level (RL)

Answer

Exploitability (E)