CS0-003 Vulnerability Management Practice Test 4 — 15 Questions

Question 1

A vulnerability scan identifies a critical unauthenticated remote-code-execution flaw on an internet-facing VPN appliance that is actively exploited in the wild. Several internal-only medium vulnerabilities are also present. What should be remediated first? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Patch or mitigate the VPN appliance immediately and verify exposure is removed. The critical unauthenticated remote-code-execution vulnerability on an internet-facing VPN appliance is actively exploited in the wild, posing an immediate risk of complete compromise. Remediation must be prioritized based on severity, exploitability, and exposure, making immediate patching or mitigation the only defensible first step.

Answer

Start with the oldest medium vulnerability

Answer

Remediate only low-risk internal findings to improve closure rate

Answer

Defer all remediation until the monthly patch window

Question 2

A scan of Windows servers reports few findings, but the scanner used no credentials. The security manager suspects missing patch data. What should be changed? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Run authenticated scans using least-privilege scanner credentials. Unauthenticated scans rely on network-visible services and banners, which miss registry-level patch data, OS configuration details, and installed updates. Authenticated scans with least-privilege credentials (e.g., using WMI, WinRM, or the Windows Update API) provide deep visibility into missing patches by querying the actual patch database (e.g., via the Microsoft Update Catalog or WSUS). This directly addresses the security manager's suspicion of missing patch data, making option C the correct choice.

Answer

Increase only the port range

Answer

Trust the unauthenticated result as complete

Answer

Disable host firewalls permanently

Question 3

A scanner flags TLS 1.0 on a server, but the service owner says TLS 1.0 is disabled. What is the BEST validation method? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Manually test the service with a TLS client or scanner profile that negotiates protocol versions. Option A is correct because the best validation method is to independently verify the server's TLS configuration by manually testing with a TLS client (e.g., OpenSSL s_client) or a scanner profile that explicitly attempts to negotiate TLS 1.0. This eliminates false positives from automated scanners that may rely on banner grabbing or outdated fingerprints, and directly confirms whether the service accepts TLS 1.0 handshakes at the protocol level.

Answer

Delete the server from the scan scope

Answer

Change the severity to informational automatically

Answer

Close the finding because the owner disagrees

Question 4

A CI pipeline blocks a container image because the base layer contains a critical OpenSSL CVE. The application team says the vulnerable binary is not used. What is the BEST next step? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Validate exploitability and rebuild from a patched base image where feasible. Option B is correct because the best next step is to validate whether the vulnerable OpenSSL binary is actually exploitable in the container's runtime context (e.g., it may be a statically linked unused library or a dead code path). If the binary is truly unused, the team should still rebuild from a patched base image where feasible to maintain a clean supply chain and avoid false-positive fatigue; if it is used, the vulnerability must be remediated. This balances security rigor with operational pragmatism, aligning with vulnerability management best practices for containerized environments.

Answer

Ship the image and document nothing

Answer

Only rename the image tag

Answer

Ignore all base-image vulnerabilities

Question 5

A cloud posture scan finds a storage bucket with public read access containing customer exports. What should the team do first? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Restrict public access and determine whether sensitive data was accessed. Option C is correct because the immediate priority is to eliminate the public read access vulnerability to prevent further unauthorized data exposure. After restricting access, the team must determine whether sensitive data was accessed by reviewing access logs (e.g., AWS CloudTrail or GCP Audit Logs) to assess the scope of potential breach, which is a standard incident response step. This approach directly mitigates the weakness without concealing risk, aligning with vulnerability management best practices.

Answer

Wait for the next quarterly review

Answer

Delete all audit logs to reduce liability

Answer

Rotate database administrator passwords only

Question 6

A vulnerability report has 900 findings. One medium CVSS vulnerability is listed in CISA KEV and has high EPSS; several high CVSS issues are not exploitable in the environment. What should the analyst recommend? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Prioritize the KEV/high-EPSS issue after confirming asset exposure. Option C is correct because CISA KEV and high EPSS indicate active exploitation in the wild, making the medium CVSS vulnerability a higher operational priority than non-exploitable high CVSS issues. The analyst must first confirm asset exposure to ensure the vulnerability actually affects the environment before recommending remediation. This aligns with risk-based vulnerability management (RBVM) principles, which prioritize exploitability and threat intelligence over CVSS base score alone.

Answer

Remediate alphabetically by CVE ID

Answer

Remediate only vulnerabilities with vendor logos in the report

Answer

Always sort only by CVSS base score

Question 7

Two servers have the same critical vulnerability. One hosts a public payment API; the other is a lab server isolated from production. What changes the remediation priority? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Asset criticality, exposure, and business impact. Remediation priority is determined by risk, which combines asset criticality, exposure, and business impact. The public payment API has high exposure (internet-facing) and high business impact (PCI DSS compliance, financial data), while the lab server is isolated and non-production. A vulnerability scanner like Nessus or Qualys uses asset tags and CVSS environmental metrics (e.g., modified impact sub-scores) to calculate a risk-based priority score, not the number of installed fonts or dashboard color.

Answer

The number of installed fonts

Answer

The colour of the scanner dashboard

Answer

Whether the hostname is shorter

Question 8

A legacy system cannot be patched because the vendor no longer supports the application. What should the vulnerability manager request? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Documented risk acceptance with compensating controls and a migration/remediation plan. When a legacy system cannot be patched due to vendor end-of-life, the vulnerability manager should request a documented risk acceptance with compensating controls and a migration/remediation plan. This is the only option that formally acknowledges the risk, implements compensating controls (e.g., network segmentation, host-based firewall rules, or application whitelisting) to reduce exploitability, and establishes a timeline to decommission or replace the system. This aligns with the risk-based prioritization required for business decisions.

Answer

Give all users local admin rights

Answer

Mark the vulnerability as fixed

Answer

Remove the system from future reports

Question 9

A development team wants to find vulnerable open-source libraries before deployment. Which control best fits this stage? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Software composition analysis in the CI/CD pipeline. Software composition analysis (SCA) is the correct control because it specifically scans open-source libraries and their dependencies for known vulnerabilities (CVEs) and license compliance issues. Integrating SCA into the CI/CD pipeline ensures that vulnerable libraries are identified automatically before the code is deployed, aligning with the shift-left security principle.

Answer

Wireless spectrum analysis

Answer

Database transaction log backups

Answer

Physical badge access reviews

Question 10

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Authenticated scanning with a test account and session handling. DAST scanners require authenticated access to crawl and test pages behind login forms. By configuring authenticated scanning with a test account and session handling (e.g., using cookies or OAuth tokens), the scanner can traverse protected routes and detect vulnerabilities such as SQL injection or XSS on authenticated pages. This directly addresses the stated weakness without masking risk.

Answer

Disable all application authentication

Answer

Treat absence of findings as proof of security

Answer

Reduce the scan to only the landing page

Question 11

A CVSS 9.8 vulnerability affects an internal service reachable only from a restricted admin subnet. Which additional analysis is most useful? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Environmental scoring and compensating-control review. Option B is correct because CVSS base scores assume a default, worst-case environment. For a vulnerability with a 9.8 base score that is only reachable from a restricted admin subnet, an environmental scoring (CVSS v3.1 Environmental Metric Group) adjusts the severity based on the actual attack surface, and a compensating-control review documents whether existing controls (e.g., network ACLs, jump-box restrictions) mitigate the risk. This analysis is essential for stakeholder management to justify the risk acceptance or remediation priority, and the resulting documentation (e.g., risk acceptance form signed by the authorizing official) keeps the program defensible under audit.

Answer

Use only the vendor marketing page

Answer

Change all findings to low severity

Answer

Ignore the vulnerability because it is internal

Question 12

A team says a critical vulnerability was patched. What should the vulnerability manager require before closure? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

A retest showing the vulnerable condition is no longer present. Option D is correct because the vulnerability manager must obtain objective evidence that the vulnerability has been remediated. A retest, either automated or manual, confirms that the specific vulnerable condition (e.g., a missing patch, misconfiguration, or outdated library) is no longer present on the asset. This aligns with the NIST SP 800-115 and PCI DSS 11.3.2 requirement for verification of remediation before closure.

Answer

Wait one year before testing

Answer

Close it immediately based on the email

Answer

Create a duplicate ticket for every asset

Question 13

A supplier provides a software product used in a regulated environment. The security team wants visibility into included libraries and versions. What should they request? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

A software bill of materials. A Software Bill of Materials (SBOM) provides a formal, machine-readable inventory of all third-party and open-source components, libraries, and their versions used in a software product. In a regulated environment, this is essential for vulnerability management and compliance, as it enables the security team to quickly identify known vulnerabilities (e.g., CVEs) in specific library versions and prioritize remediation based on risk.

Answer

A DNS MX record report

Answer

A password complexity screenshot only

Answer

A building floor plan

Question 14

A business unit accepts the risk of delaying a patch because downtime would breach a contractual deadline. What should be updated? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

The risk register with owner, justification, expiry date, and compensating controls. When a business unit formally accepts the risk of delaying a patch due to contractual constraints, the risk must be documented in the risk register. This entry should include the owner, justification, expiry date, and compensating controls to ensure the risk is tracked, reviewed, and eventually remediated. This aligns with the vulnerability management lifecycle, where accepted risks require formal documentation and periodic reassessment.

Answer

The firewall vendor invoice

Answer

The incident containment playbook only

Answer

The phishing training completion list

Question 15

A credentialed Linux scan fails on several hosts after SSH hardening. What is the BEST next step? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Review scanner account permissions, allowed authentication methods, and sudo command restrictions. After SSH hardening, the credentialed scan fails because the scanner's authentication methods (e.g., password, public key) or sudo commands may be restricted. Option B is correct because reviewing scanner account permissions, allowed authentication methods, and sudo command restrictions directly addresses the root cause—ensuring the scanner can authenticate and execute privileged commands without bypassing security controls.

Answer

Assume the hosts have no vulnerabilities

Answer

Run only unauthenticated scans forever

Answer

Disable SSH on all servers