CS0-003 Vulnerability Management Practice Test 9 — 15 Questions

Question 1

A security analyst is using OpenVAS to perform a vulnerability scan of an internal network. The scan completes and generates a report listing several vulnerabilities. What is the next step in the vulnerability lifecycle?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Prioritization. After discovery (scanning), the next step is prioritization of vulnerabilities based on risk, exploitability, and business impact.

Answer

Verification

Answer

Reporting

Answer

Remediation

Question 2

An organization is implementing a patch management process and wants to track compliance. They deploy patches to a test group of systems before rolling out to the entire environment. After patching the test group, they run a vulnerability scan and find that 95% of the vulnerabilities are resolved. What should the organization do next?

Accepted Answer

Verify the patch on test systems and then proceed with full deployment through change management.. After successful testing, the next step is to deploy the patch to the rest of the environment, following change management procedures.

Answer

Run another scan on the test group in a week to confirm persistence.

Answer

Immediately deploy the patch to all systems without further testing.

Answer

Skip full deployment and rely on the test group results.

Question 3

A security analyst is reviewing a DAST report from Burp Suite for a web application. The report indicates a potential Server-Side Request Forgery (SSRF) vulnerability in a feature that fetches URLs. Which of the following is the most effective mitigation?

Accepted Answer

Use a whitelist of allowed URLs and validate user input against it.. SSRF can be mitigated by validating and sanitizing user input, whitelisting allowed URLs, and blocking access to internal networks.

Answer

Disable the URL fetching feature entirely.

Answer

Increase memory limits on the server to prevent resource exhaustion.

Answer

Implement a Web Application Firewall (WAF) to block malicious requests.

Question 4

A security analyst is using Qualys to perform a vulnerability scan on a public-facing web server. The scan results show that the server is running an outdated version of Apache HTTP Server with multiple known vulnerabilities. The analyst checks the vendor security advisories and finds that a patch was released three months ago. However, the server is in a staging environment and not yet in production. What should the analyst recommend?

Accepted Answer

Patch the server immediately because it poses a risk to the staging network.. Even in staging, an unpatched public-facing web server with known Apache vulnerabilities is exploitable and can serve as a pivot point into the staging network or be used to attack other environments. Best practice is to patch immediately regardless of environment, because staging often shares credentials, network paths, or data with production. Deferring patching until production migration compounds risk.

Answer

Only patch if the vulnerability is rated critical.

Answer

Do not patch because the server is not in production.

Answer

Wait until the server moves to production to patch.

Question 5

Which of the following tools is specifically designed for compliance scanning against security benchmarks such as CIS and STIG?

Accepted Answer

OpenSCAP. OpenSCAP is an open-source tool specifically designed for compliance scanning against security benchmarks like CIS and STIG. It uses SCAP (Security Content Automation Protocol) standards to automate vulnerability management and compliance checking. It can evaluate systems against predefined policies and generate reports.

Answer

OpenVAS

Answer

Nessus

Answer

Trivy

Question 6

A security analyst is prioritizing vulnerabilities discovered during a scan. Which TWO factors should the analyst consider as part of business context to determine remediation priority? (Select TWO.)

Accepted Answer

Asset exposure. Asset exposure (A) is a business-context factor because it describes whether the vulnerable asset is reachable from untrusted networks such as the internet, DMZ, or internal segments, directly affecting the likelihood of exploitation and thus remediation priority. Asset criticality (E) is also business context because it reflects the asset's role and value to the organization—such as processing regulated data, supporting revenue-generating services, or being a domain controller—which determines the business impact if compromised. In contrast, CVSS base score (B) is a technical severity metric derived from intrinsic vulnerability characteristics and does not by itself capture business context. Patch availability (C) is a remediation logistics factor, and exploit availability (D) is a threat-intelligence factor; neither is a business-context input for prioritization.

Answer

CVSS base score

Answer

Patch availability

Answer

Exploit availability

Question 7

A security analyst is performing an API vulnerability test using OWASP ZAP. The analyst finds several issues. Which THREE of the following are common API vulnerabilities according to OWASP? (Select THREE.)

Accepted Answer

Broken Object Level Authorization. Broken Object Level Authorization (A) is correct because it is the #1 item on the OWASP API Security Top 10, occurring when an API fails to verify that the requesting user owns or is authorized to access the specific object referenced by an ID in the request (e.g., /api/users/123), allowing horizontal privilege escalation via IDOR-style attacks. Excessive Data Exposure (B) is correct because it is a recognized OWASP API risk where APIs return full objects with sensitive fields (PII, tokens, internal attributes) and rely on the client to filter, exposing data the consumer should never receive. Broken Authentication (E) is correct because it is a core OWASP API Security Top 10 category covering weak credential handling, missing token validation, improper JWT verification, and absent rate limiting on authentication endpoints. SQL Injection (C) and Cross-Site Scripting (D) are not API-specific OWASP API Top 10 categories; they are classic web application vulnerabilities listed in the OWASP Top 10 for web apps, and while an API could theoretically be affected, they are not among the API-specific vulnerabilities the question asks for.

Answer

SQL Injection

Answer

Cross-Site Scripting (XSS)

Question 8

A security team is deploying a new web application and wants to ensure it follows secure configuration practices. Which THREE of the following are recommended configuration settings according to CIS benchmarks for web servers? (Select THREE.)

Accepted Answer

Disable directory listing. Option A (Disable directory listing) is correct because CIS benchmarks for web servers require turning off autoindex/directory browsing so that attackers cannot enumerate files and directories that lack an index page, reducing information disclosure. Option C (Enforce HTTPS) is correct because CIS guidance mandates TLS-protected transport, typically by redirecting or rejecting plain HTTP and configuring strong protocols/ciphers, to protect credentials and session data in transit. Option E (Remove default accounts) is correct because CIS benchmarks require deleting or disabling vendor-supplied default accounts and sample content, since these often ship with well-known credentials and are a common initial-access vector. Option B (Use HTTP instead of HTTPS) does not belong because plain HTTP transmits data unencrypted and directly contradicts the requirement to enforce HTTPS. Option D (Enable automatic directory browsing) does not belong because automatic directory listing is the exact behavior that disabling directory listing is meant to prevent, and it exposes the server's file structure to unauthenticated users.

Answer

Use HTTP instead of HTTPS

Answer

Enable automatic directory browsing

Question 9

A security analyst is reviewing a vulnerability scan report and sees a critical finding with a CVSS v3.1 base score of 9.8. The vector string is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which of the following best describes the attack vector component (AV:N)?

Accepted Answer

The attacker can exploit the vulnerability over a network from a remote system. In CVSS v3.1, the Attack Vector (AV) metric describes how the vulnerability is exploited. AV:N (Network) means the vulnerable component is reachable over a network layer (e.g., the internet or a LAN) and the attacker does not need local or physical access. This is the most severe AV value and contributes to the high base score of 9.8 in the given vector.

Answer

The attacker must be on the same physical network segment

Answer

The attacker requires local access to the target system

Answer

The attacker must be physically present at the device

Question 10

During a vulnerability assessment, a security analyst discovers a web application that is vulnerable to SQL injection. The application is a legacy system that cannot be easily patched. The analyst recommends implementing a web application firewall (WAF) rule to block malicious SQL patterns. Which type of control does this represent?

Accepted Answer

Compensating control. A compensating control is an alternative control that mitigates risk when the primary control (patch) cannot be applied.

Answer

Corrective control

Answer

Preventive control

Answer

Detective control

Question 11

A security team uses the Common Vulnerability Scoring System (CVSS) v3.1 to prioritize vulnerabilities. They find a vulnerability with a base score of 7.5 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. However, the asset is a public-facing web server with no backups. The team also checks the Exploit Prediction Scoring System (EPSS) and sees a score of 0.95 (95% probability of exploitation in the next 30 days). Which action should the team take first based on prioritizing by risk?

Accepted Answer

Expedite patch testing and deployment, and consider emergency change procedures. With a CVSS base score of 7.5 (High) affecting a public-facing web server, no backups, and an EPSS score of 0.95 indicating a 95% probability of exploitation within 30 days, the risk is extreme — active exploitation is imminent and recovery would be impossible without backups. The correct first action is to expedite patch testing and deployment while invoking emergency change procedures to compress the normal change-management timeline without abandoning testing. This balances urgency with the operational discipline required to avoid introducing new outages.

Answer

Apply the patch within the next 30 days as part of routine maintenance

Answer

Implement a network-based intrusion prevention system signature to block exploitation attempts

Answer

Deploy the patch immediately in the production environment without testing

Question 12

A security analyst is configuring a container scanning tool to identify vulnerabilities in Docker images before deployment. Which of the following tools is specifically designed for container image vulnerability scanning?

Accepted Answer

Trivy. Trivy is an open-source vulnerability scanner from Aqua Security specifically designed to scan container images, filesystems, and IaC for vulnerabilities and misconfigurations. It integrates directly with Docker and CI/CD pipelines to detect CVEs in OS packages and application dependencies before deployment. This makes it the correct tool for pre-deployment container image scanning.

Answer

Burp Suite

Answer

Nessus

Answer

OpenVAS

Question 13

Which of the following best describes the purpose of the CISA Known Exploited Vulnerabilities (KEV) catalog in vulnerability management?

Accepted Answer

It lists vulnerabilities that are known to have been exploited in the wild. The CISA Known Exploited Vulnerabilities (KEV) catalog is a authoritative list maintained by CISA that enumerates vulnerabilities confirmed to have been exploited in the wild. Its purpose is to help organizations prioritize remediation by focusing on vulnerabilities with active exploitation evidence, not theoretical risk. This makes it a key input for risk-based vulnerability management and for meeting Binding Operational Directive 22-01 requirements for federal agencies.

Answer

It provides a framework for conducting penetration tests

Answer

It provides a scoring system for vulnerability severity

Answer

It offers a database of configuration baselines for operating systems

Question 14

A security analyst is reviewing a vulnerability scan report and notices that a plugin output indicates a potential misconfiguration in a web server that allows directory listing. The analyst wants to verify this finding manually. Which of the following tools would be most appropriate to confirm the vulnerability?

Accepted Answer

Burp Suite. Burp Suite is a web application security testing tool that can be used to manually verify web vulnerabilities like directory listing by intercepting and modifying requests.

Answer

Metasploit

Answer

Wireshark

Answer

Nmap

Question 15

During a vulnerability assessment of a Kubernetes cluster, a security analyst finds that a container is running with privileged mode enabled and has a hostPath mount that grants write access to the host's /var/log directory. Which of the following is the most significant security risk associated with this configuration?

Accepted Answer

Potential for container escape and host node compromise. A container running in privileged mode with a hostPath mount that grants write access to the host's /var/log directory poses a significant risk of container escape and host node compromise. Privileged mode gives the container almost all capabilities of the host, and the hostPath mount allows direct write access to host files, enabling an attacker to modify system logs, plant malware, or escalate privileges to the host.

Answer

Data leakage through unrestricted storage access

Answer

Excessive network permissions allowing lateral movement

Answer

Increased attack surface due to unnecessary services running in the container