CS0-003 Vulnerability Management Practice Test 3 — 15 Questions

Question 1

A vulnerability scan identifies a critical unauthenticated remote-code-execution flaw on an internet-facing VPN appliance that is actively exploited in the wild. Several internal-only medium vulnerabilities are also present. What should be remediated first? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Patch or mitigate the VPN appliance immediately and verify exposure is removed. The VPN appliance's critical unauthenticated remote-code-execution flaw is actively exploited in the wild, posing an immediate and severe risk to the entire network perimeter. Remediating this first aligns with the vulnerability management principle of prioritizing by risk severity and exploitability, as an internet-facing device with a known active exploit bypasses all authentication controls and can lead to full compromise. Patching or mitigating it directly removes the exposure without obscuring the risk, unlike compensating controls that might hide the underlying weakness.

Answer

Remediate only low-risk internal findings to improve closure rate

Answer

Start with the oldest medium vulnerability

Answer

Defer all remediation until the monthly patch window

Question 2

A scan of Windows servers reports few findings, but the scanner used no credentials. The security manager suspects missing patch data. What should be changed? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Run authenticated scans using least-privilege scanner credentials. Unauthenticated scans only enumerate open ports and services visible without credentials, missing OS-level patch data such as missing KBs, registry settings, or file versions. Authenticated scans using least-privilege credentials allow the scanner to query the Windows registry, WMI, or WinRM to retrieve the actual installed patch level, providing accurate vulnerability results. For stakeholder management, formal approval (e.g., a signed authorization from system owners or change control board) is required to document the use of privileged credentials, ensuring the program remains defensible in audits.

Answer

Trust the unauthenticated result as complete

Answer

Increase only the port range

Answer

Disable host firewalls permanently

Question 3

A scanner flags TLS 1.0 on a server, but the service owner says TLS 1.0 is disabled. What is the BEST validation method? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Manually test the service with a TLS client or scanner profile that negotiates protocol versions. Option D is correct because the most reliable way to validate whether TLS 1.0 is truly disabled is to perform an active, negotiated test using a TLS client (e.g., OpenSSL s_client) or a scanner profile that explicitly attempts to connect using only TLS 1.0. This bypasses any potential misconfiguration in the scanner's service detection or version negotiation logic, and directly confirms whether the server accepts a TLS 1.0 handshake. Relying solely on the scanner's banner grab or the owner's assertion can miss cases where the server still supports the protocol on certain ports or under specific cipher suites.

Answer

Change the severity to informational automatically

Answer

Delete the server from the scan scope

Answer

Close the finding because the owner disagrees

Question 4

A CI pipeline blocks a container image because the base layer contains a critical OpenSSL CVE. The application team says the vulnerable binary is not used. What is the BEST next step? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Validate exploitability and rebuild from a patched base image where feasible. Option C is correct because the best next step is to validate whether the vulnerable OpenSSL binary is actually reachable or exploitable in the running container, and then rebuild from a patched base image if feasible. This balances security with business priorities by avoiding unnecessary rebuilds for non-exploitable vulnerabilities while ensuring that truly exploitable CVEs are remediated. Simply ignoring or renaming the tag does not address the underlying risk and violates secure CI/CD practices.

Answer

Ignore all base-image vulnerabilities

Answer

Only rename the image tag

Answer

Ship the image and document nothing

Question 5

A cloud posture scan finds a storage bucket with public read access containing customer exports. What should the team do first? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Restrict public access and determine whether sensitive data was accessed. Option D is correct because the immediate priority is to restrict public read access to the storage bucket to prevent further unauthorized exposure, then determine whether sensitive customer data was accessed by reviewing access logs (e.g., AWS CloudTrail or S3 server access logs). This aligns with incident response best practices: contain the threat first, then assess impact. Without confirming data access, the team cannot properly scope the breach or notify affected parties.

Answer

Wait for the next quarterly review

Answer

Rotate database administrator passwords only

Answer

Delete all audit logs to reduce liability

Question 6

A vulnerability report has 900 findings. One medium CVSS vulnerability is listed in CISA KEV and has high EPSS; several high CVSS issues are not exploitable in the environment. What should the analyst recommend? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Prioritize the KEV/high-EPSS issue after confirming asset exposure. Option C is correct because it combines external threat intelligence (CISA KEV and EPSS) with internal context (asset exposure) to prioritize a medium-severity vulnerability that is actively exploited and has a high probability of exploitation. This approach aligns with the NIST framework for risk-based vulnerability management, which emphasizes that not all high-CVSS vulnerabilities are exploitable in a given environment, while lower-scored vulnerabilities in KEV pose immediate risk.

Answer

Always sort only by CVSS base score

Answer

Remediate alphabetically by CVE ID

Answer

Remediate only vulnerabilities with vendor logos in the report

Question 7

Two servers have the same critical vulnerability. One hosts a public payment API; the other is a lab server isolated from production. What changes the remediation priority? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Asset criticality, exposure, and business impact. D is correct because remediation priority is determined by asset criticality, exposure, and business impact, not by superficial attributes. The public payment API has high business impact and exposure, making it a higher priority than the isolated lab server, even though both share the same vulnerability. This aligns with risk-based vulnerability management principles where context (e.g., data sensitivity, network reachability) drives patching order.

Answer

The colour of the scanner dashboard

Answer

The number of installed fonts

Answer

Whether the hostname is shorter

Question 8

A legacy system cannot be patched because the vendor no longer supports the application. What should the vulnerability manager request? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Documented risk acceptance with compensating controls and a migration/remediation plan. Option B is correct because when a legacy system cannot be patched due to vendor end-of-life, the vulnerability manager must formally accept the risk through documented risk acceptance, implement compensating controls (e.g., network segmentation, host-based firewall rules, or application whitelisting), and create a migration or remediation plan to eventually retire or replace the system. This aligns with the NIST SP 800-53 risk management framework and ensures auditability and accountability for the unpatched vulnerability.

Answer

Give all users local admin rights

Answer

Mark the vulnerability as fixed

Answer

Remove the system from future reports

Question 9

A development team wants to find vulnerable open-source libraries before deployment. Which control best fits this stage? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Software composition analysis in the CI/CD pipeline. Software Composition Analysis (SCA) is the correct control because it specifically scans open-source libraries for known vulnerabilities (CVEs) and license compliance issues. Integrating SCA into the CI/CD pipeline ensures vulnerabilities are detected and blocked before the code is deployed, aligning with the 'shift left' security principle. This directly addresses the team's goal of finding vulnerable open-source libraries pre-deployment.

Answer

Database transaction log backups

Answer

Physical badge access reviews

Answer

Wireless spectrum analysis

Question 10

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Authenticated scanning with a test account and session handling. DAST scanners require authenticated sessions to crawl and test pages behind login forms. Configuring authenticated scanning with a test account and proper session handling (e.g., cookie-based or token-based authentication) allows the scanner to maintain state and reach protected endpoints. Without this, the scanner only sees public content, missing vulnerabilities in authenticated areas.

Answer

Disable all application authentication

Answer

Treat absence of findings as proof of security

Answer

Reduce the scan to only the landing page

Question 11

A CVSS 9.8 vulnerability affects an internal service reachable only from a restricted admin subnet. Which additional analysis is most useful? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Environmental scoring and compensating-control review. Option C is correct because a CVSS 9.8 vulnerability (critical, with network attack vector, low complexity, no privileges required, and no user interaction) that is only reachable from a restricted admin subnet requires environmental scoring to adjust the base score based on the actual attack surface (e.g., modified attack vector to 'adjacent network' or 'local') and a compensating-control review to verify that existing security measures (e.g., strict ACLs, jump-box requirements, network segmentation) effectively mitigate the risk. This approach aligns with the CVSS specification (v3.1) for environmental metrics and NIST SP 800-30 guidance for risk assessment, ensuring that the residual risk is accurately understood before selecting controls.

Answer

Ignore the vulnerability because it is internal

Answer

Use only the vendor marketing page

Answer

Change all findings to low severity

Question 12

A team says a critical vulnerability was patched. What should the vulnerability manager require before closure? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

A retest showing the vulnerable condition is no longer present. Option C is correct because the vulnerability manager must obtain objective evidence that the vulnerability has been remediated before closing the finding. An email assertion is insufficient; a retest (manual or automated) confirming the vulnerable condition is no longer present provides the verifiable proof required for closure and defensible stakeholder reporting.

Answer

Close it immediately based on the email

Answer

Wait one year before testing

Answer

Create a duplicate ticket for every asset

Question 13

A supplier provides a software product used in a regulated environment. The security team wants visibility into included libraries and versions. What should they request? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

A software bill of materials. A software bill of materials (SBOM) is a formal, machine-readable inventory of all components, libraries, and versions used in a software product. In a regulated environment, an SBOM provides the security team with the visibility needed to assess vulnerabilities, track supply chain risks, and ensure compliance with standards like NIST SP 800-53 or FDA guidance. Requesting an SBOM directly addresses the need for library and version transparency.

Answer

A DNS MX record report

Answer

A building floor plan

Answer

A password complexity screenshot only

Question 14

A business unit accepts the risk of delaying a patch because downtime would breach a contractual deadline. What should be updated? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

The risk register with owner, justification, expiry date, and compensating controls. When a business unit formally accepts the risk of delaying a patch due to contractual constraints, the risk register must be updated to document the risk owner, justification, expiry date, and compensating controls. This ensures the risk is tracked, reviewed, and mitigated within an acceptable timeframe, aligning with vulnerability management and risk acceptance processes.

Answer

The incident containment playbook only

Answer

The firewall vendor invoice

Answer

The phishing training completion list

Question 15

A credentialed Linux scan fails on several hosts after SSH hardening. What is the BEST next step? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Review scanner account permissions, allowed authentication methods, and sudo command restrictions. Option D is correct because SSH hardening (e.g., disabling password authentication, restricting ciphers, or enforcing key-based login) can break credentialed scans if the scanner's account permissions, allowed authentication methods, or sudo command restrictions are not aligned with the new configuration. Reviewing these settings ensures the scanner can authenticate and execute privileged commands, restoring scan coverage without compromising security.

Answer

Run only unauthenticated scans forever

Answer

Disable SSH on all servers

Answer

Assume the hosts have no vulnerabilities