CS0-003 Vulnerability Management Practice Test 9 — 15 Questions

Question 1

A security analyst is reviewing a vulnerability scan report and sees a critical finding with a CVSS v3.1 base score of 9.8. The vector string is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which of the following best describes the attack vector component (AV:N)?

Accepted Answer

The attacker can exploit the vulnerability over a network from a remote system. AV:N means the vulnerability can be exploited over a network, such as the internet, without requiring physical or local access.

Answer

The attacker must be on the same physical network segment

Answer

The attacker requires local access to the target system

Answer

The attacker must be physically present at the device

Question 2

During a vulnerability assessment, a security analyst discovers a web application that is vulnerable to SQL injection. The application is a legacy system that cannot be easily patched. The analyst recommends implementing a web application firewall (WAF) rule to block malicious SQL patterns. Which type of control does this represent?

Accepted Answer

Compensating control. A compensating control is an alternative control that mitigates risk when the primary control (patch) cannot be applied.

Answer

Corrective control

Answer

Preventive control

Answer

Detective control

Question 3

A security team uses the Common Vulnerability Scoring System (CVSS) v3.1 to prioritize vulnerabilities. They find a vulnerability with a base score of 7.5 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. However, the asset is a public-facing web server with no backups. The team also checks the Exploit Prediction Scoring System (EPSS) and sees a score of 0.95 (95% probability of exploitation in the next 30 days). Which action should the team take first based on prioritizing by risk?

Accepted Answer

Expedite patch testing and deployment, and consider emergency change procedures. The high EPSS score indicates imminent exploitation, and the impact to availability is high. The CVSS impact reflects a potential denial of service, which is critical for a public-facing server. The lack of backups increases the risk of data loss or extended downtime. Therefore, immediate patching is the priority.

Answer

Apply the patch within the next 30 days as part of routine maintenance

Answer

Implement a network-based intrusion prevention system signature to block exploitation attempts

Answer

Deploy the patch immediately in the production environment without testing

Question 4

A security analyst is configuring a container scanning tool to identify vulnerabilities in Docker images before deployment. Which of the following tools is specifically designed for container image vulnerability scanning?

Accepted Answer

Trivy. Trivy is an open-source vulnerability scanner for container images, filesystems, and Git repositories.

Answer

Burp Suite

Answer

Nessus

Answer

OpenVAS

Question 5

Which of the following best describes the purpose of the CISA Known Exploited Vulnerabilities (KEV) catalog in vulnerability management?

Accepted Answer

It lists vulnerabilities that are known to have been exploited in the wild. The KEV catalog is a list of vulnerabilities that have been actively exploited in the wild, published by CISA to help organizations prioritize patching.

Answer

It provides a framework for conducting penetration tests

Answer

It provides a scoring system for vulnerability severity

Answer

It offers a database of configuration baselines for operating systems

Question 6

A security analyst is reviewing a vulnerability scan report and notices that a plugin output indicates a potential misconfiguration in a web server that allows directory listing. The analyst wants to verify this finding manually. Which of the following tools would be most appropriate to confirm the vulnerability?

Accepted Answer

Burp Suite. Burp Suite is a web application security testing tool that can be used to manually verify web vulnerabilities like directory listing by intercepting and modifying requests.

Answer

Metasploit

Answer

Wireshark

Answer

Nmap

Question 7

During a vulnerability assessment of a Kubernetes cluster, a security analyst finds that a container is running with privileged mode enabled and has a hostPath mount that grants write access to the host's /var/log directory. Which of the following is the most significant security risk associated with this configuration?

Accepted Answer

Potential for container escape and host node compromise. Privileged containers combined with hostPath mounts can allow container escape, enabling an attacker to gain root access on the host node.

Answer

Data leakage through unrestricted storage access

Answer

Excessive network permissions allowing lateral movement

Answer

Increased attack surface due to unnecessary services running in the container

Question 8

An organization is implementing a patch management process for servers. Which of the following is a crucial step that should be performed before deploying patches to production servers?

Accepted Answer

Test the patch in a staging environment that closely mirrors production. Testing patches in a staging environment that mirrors production helps identify issues that could cause outages or incompatibilities.

Answer

Immediately apply the patch to all systems to minimize exposure

Answer

Review the CVSS score to decide if the patch is necessary

Answer

Verify patch compliance by checking the vendor's advisory

Question 9

A cybersecurity analyst is reviewing the configuration of a Linux server against CIS Benchmarks. The analyst notices that several settings deviate from the recommended baseline. Which TWO of the following are most likely to be considered Level 1 CIS Benchmark recommendations?

Accepted Answer

Set password expiration to 90 days. CIS Level 1 recommendations are basic security settings that do not cause significant operational impact. Setting password expiration and disabling root SSH login are common Level 1 items.

Answer

Remove all unnecessary packages and services

Answer

Enable mandatory access control (SELinux) in enforcing mode

Answer

Configure audit rules for file permission changes

Question 10

A security analyst is conducting a dynamic application security testing (DAST) scan of a REST API. The scanner reports a potential Server-Side Request Forgery (SSRF) vulnerability. The analyst needs to confirm the finding manually. Which TWO of the following techniques are most appropriate for validating SSRF?

Accepted Answer

Submit a payload that triggers the server to send a request to an attacker-controlled external server (e.g., Burp Collaborator). SSRF can be confirmed by making requests to internal resources (e.g., localhost) and observing responses, or by using an external collaborator service to detect out-of-band callbacks.

Answer

Inject malicious SQL queries into input fields to see if they are executed

Answer

Attempt to upload a malicious file to the server

Answer

Modify HTTP headers to test for cross-site scripting

Question 11

A security analyst is using a vulnerability scanner to identify missing patches on Windows servers. The scanner uses plugins that reference Common Vulnerabilities and Exposures (CVE) identifiers. Which THREE of the following are components of a CVSS v3.1 base score vector?

Accepted Answer

Attack Vector (AV). Attack Vector (AV), Privileges Required (PR), and Confidentiality (C) are all part of the CVSS v3.1 base metric group.

Answer

Remediation Level (RL)

Answer

Exploitability (E)

Question 12

A company uses a patch management tool to track compliance across its server fleet. The security team needs to prioritize vulnerabilities for patching. Which THREE factors should be considered when prioritizing?

Accepted Answer

EPSS probability score. CVSS score indicates severity, EPSS estimates exploitation likelihood, and asset criticality reflects business impact. Patch availability is more about remediation capability than prioritization.

Answer

Availability of a patch from the vendor

Answer

Number of plugins that detected the vulnerability

Question 13

A security analyst is reviewing a compliance scan report for a DoD environment that uses Security Technical Implementation Guides (STIGs). The report indicates several failures. Which TWO of the following are likely STIG requirements for a Windows 10 system?

Accepted Answer

Enable Windows Defender Credential Guard. STIGs often require complex passwords (14+ characters) and disabling legacy protocols like SMBv1 to meet DoD security standards.

Answer

Allow automatic logon with empty password

Answer

Disable audit log generation for failed logins

Answer

Enable SMBv1 protocol for compatibility

Question 14

A security analyst is selecting tools for vulnerability management. Which THREE of the following are vulnerability scanning tools?

Accepted Answer

Nessus. Nessus, Qualys, and OpenVAS are well-known vulnerability scanners. Lynis is a security auditing tool for hardening, but not primarily a vulnerability scanner, and Wireshark is a network protocol analyzer.

Answer

Lynis

Answer

Wireshark

Question 15

A security analyst is performing a web application security assessment and identifies a potential cross-site scripting (XSS) vulnerability. The application is critical to business operations. Which TWO of the following are appropriate immediate actions?

Accepted Answer

Implement a web application firewall (WAF) rule to block XSS payloads. Reporting the vulnerability to the development team ensures awareness, and implementing a WAF rule can provide temporary protection while a fix is developed.

Answer

Take the application offline immediately

Answer

Ignore the finding because XSS is low risk

Answer

Notify law enforcement immediately