CS0-003 Vulnerability Management — Timed 10 Questions

Question 1

A security analyst is reviewing vulnerability scan results and notices that a critical vulnerability on a web server has a CVSS v3.1 base score of 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which component of the CVSS vector indicates that the vulnerability can be exploited from a remote network?

Accepted Answer

AV:N. AV stands for Attack Vector. AV:N means the vulnerability is exploitable over a network, indicating remote exploitation.

Answer

PR:N

Answer

AC:L

Answer

UI:N

Question 2

A security analyst is using the EPSS to prioritize vulnerabilities for remediation. EPSS is designed to estimate the likelihood that a vulnerability will be exploited in the wild. Which of the following best describes how EPSS should be used in vulnerability management?

Accepted Answer

EPSS should be used as one of several factors in a risk-based prioritization approach.. EPSS provides a probability score (0-1) that a vulnerability will be exploited in the wild within 30 days. It should be used alongside other factors like asset criticality and business context for prioritization.

Answer

EPSS is only relevant for high-severity vulnerabilities with a CVSS score above 9.0.

Answer

EPSS replaces the need for vulnerability scanning because it predicts exploitability.

Answer

EPSS alone should determine the remediation order, ignoring asset criticality.

Question 3

During a vulnerability assessment, a security analyst runs a scan using OpenVAS and reviews the results. One finding indicates a plugin with ID 12345 that detects a missing patch for CVE-2023-1234 on a Linux server. The server is a critical domain controller. Which step of the vulnerability lifecycle is the analyst currently performing?

Accepted Answer

Discovery. The analyst is identifying vulnerabilities via scanning, which is the discovery phase. Prioritization, remediation, and verification come later.

Answer

Remediation

Answer

Prioritization

Answer

Verification

Question 4

A security team is implementing configuration management for a set of Linux servers in a non-DoD environment. They want to apply a security baseline that provides a balanced approach between security and operational efficiency. Which of the following would be most appropriate?

Accepted Answer

CIS Level 1 Benchmark. CIS Benchmarks offer two levels: Level 1 is intended for environments where usability is still a priority, and Level 2 is for high-security environments. For a non-DoD environment, CIS Level 1 is appropriate.

Answer

OWASP Top 10

Answer

CIS Level 2 Benchmark

Answer

STIG for Linux

Question 5

An organization uses a DAST tool to scan a web application. The scanner reports a finding where user input is reflected in the HTTP response without proper encoding. Which OWASP Top 10 category best describes this vulnerability?

Accepted Answer

Cross-Site Scripting (XSS). Reflected XSS occurs when user input is reflected in the response without proper sanitization, leading to script execution. This falls under injection or XSS, but specifically Cross-Site Scripting (XSS) is in the OWASP Top 10 as a type of injection.

Answer

Injection

Answer

Broken Access Control

Answer

Security Misconfiguration

Question 6

A security analyst is using Burp Suite to test an API endpoint. The analyst notices that the API returns detailed error messages when invalid input is provided, revealing database schema information. Which OWASP Top 10 category does this issue primarily relate to?

Accepted Answer

Security Misconfiguration. Detailed error messages revealing internal details are a form of security misconfiguration. The OWASP Top 10 category 'Security Misconfiguration' includes verbose error messages that leak information.

Answer

Injection

Answer

Broken Access Control

Answer

Cryptographic Failures

Question 7

A security team is scanning container images with Trivy and finds a vulnerability with CVSS v3.1 vector AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability exists in a container running as a privileged container on a Kubernetes cluster. The team is prioritizing based on risk. Given the CVSS vector, which factor most significantly reduces the likelihood of exploitation in this context?

Accepted Answer

Attack Vector: Local. AV:L (Local) means the attacker must have local access to exploit. AC:H (High) and PR:H (High) are also limiting, but the attack vector being local means remote exploitation is not possible, which is a strong limiting factor. However, the question asks 'most significantly reduces the likelihood'. While local access is limiting, Attack Complexity High also reduces likelihood. But AV:L is more significant because it restricts the attack source. In the context of a container, local access might be more achievable, but still the vector shows it's not remotely exploitable. The best answer is Attack Vector: Local.

Answer

Privileges Required: High

Answer

Attack Complexity: High

Answer

User Interaction: None

Question 8

During a configuration compliance scan using OpenSCAP, a security analyst finds that several Windows servers have the 'Network access: Do not allow anonymous enumeration of SAM accounts' setting set to 'Disabled'. This finding corresponds to a CIS Benchmark recommendation. Which of the following describes the most appropriate remediation step for this finding?

Accepted Answer

Enable the policy 'Network access: Do not allow anonymous enumeration of SAM accounts' via Group Policy.. The setting should be enabled to prevent anonymous enumeration of SAM accounts. The remediation is to change the policy setting via Group Policy or local security policy.

Answer

Disable the Guest account on all servers.

Answer

Apply a registry key to disable anonymous enumeration.

Answer

Restrict anonymous access using IPsec rules.

Question 9

A security analyst needs to verify that a critical patch was successfully applied to all endpoints in the organization after an emergency patch deployment. Which phase of the vulnerability lifecycle is the analyst performing?

Accepted Answer

Verification. Verification ensures that remediation (patch application) was effective. It occurs after the fix is applied.

Answer

Remediation

Answer

Prioritization

Answer

Discovery

Question 10

A company uses Qualys to scan their internal network. The scan report shows a vulnerability with plugin output indicating that the server is running a version of Apache httpd vulnerable to CVE-2023-1234. The asset is a development web server that is not exposed to the internet. The CVSS score is 7.5 (High). However, the EPSS score is 0.001 (very low). Which of the following should be the primary factor in prioritizing this vulnerability?

Accepted Answer

The asset is a development server not exposed to the internet, so remediation should be scheduled during normal maintenance.. Since the EPSS score is very low, the likelihood of exploitation in the wild is minimal. Additionally, the asset is not internet-facing, reducing exposure. The best approach is to consider the business context and asset criticality; development servers may be lower priority. However, among the options, the EPSS score is a strong indicator of exploitability. But given the low EPSS, the vulnerability might be deprioritized. The question asks for primary factor; business context (asset criticality and exposure) is key. But options include both EPSS and business context. The answer should be business context because the asset is internal and EPSS low, but business context might still prioritize if critical. However, in this scenario, the development server is likely not critical. The most appropriate is to consider the business context including asset criticality and exposure.

Answer

The CVSS score of 7.5 indicates high severity, so it should be remediated immediately.

Answer

The EPSS score of 0.001 indicates very low exploitability, so remediation can be delayed.

Answer

The vulnerability is in Apache httpd, which is widely used, so it must be patched within 24 hours.