CS0-003 Vulnerability Management Practice Test 5 — 15 Questions

Question 1

A vulnerability scan identifies a critical unauthenticated remote-code-execution flaw on an internet-facing VPN appliance that is actively exploited in the wild. Several internal-only medium vulnerabilities are also present. What should be remediated first? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Patch or mitigate the VPN appliance immediately and verify exposure is removed. Option B is correct because the vulnerability is a critical unauthenticated remote-code-execution (RCE) flaw on an internet-facing VPN appliance that is actively exploited in the wild. According to the CVSS scoring system, such a flaw (typically CVSS 9.0–10.0) poses an immediate and severe risk to the organization's perimeter, and remediation must be prioritized over all internal-only medium vulnerabilities. The principle of risk-based prioritization dictates that externally exploitable, actively weaponized vulnerabilities must be patched or mitigated first to prevent a likely breach.

Answer

Remediate only low-risk internal findings to improve closure rate

Answer

Start with the oldest medium vulnerability

Answer

Defer all remediation until the monthly patch window

Question 2

A scan of Windows servers reports few findings, but the scanner used no credentials. The security manager suspects missing patch data. What should be changed? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Run authenticated scans using least-privilege scanner credentials. Without credentials, a vulnerability scanner can only perform unauthenticated checks, which miss many Windows patch vulnerabilities that require registry or file-level access. Running authenticated scans with least-privilege credentials allows the scanner to query the Windows Update Agent API and check installed KBs, providing accurate patch data. This directly addresses the security manager's concern about missing patch data.

Answer

Disable host firewalls permanently

Answer

Increase only the port range

Answer

Trust the unauthenticated result as complete

Question 3

A scanner flags TLS 1.0 on a server, but the service owner says TLS 1.0 is disabled. What is the BEST validation method? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Manually test the service with a TLS client or scanner profile that negotiates protocol versions. Option D is correct because the only way to definitively resolve a discrepancy between a scanner finding and a service owner's claim is to perform an independent, manual test. Using a TLS client (e.g., OpenSSL s_client) or a scanner profile that specifically negotiates protocol versions allows you to directly verify whether the server actually accepts TLS 1.0 connections, eliminating false positives or misconfigurations.

Answer

Change the severity to informational automatically

Answer

Close the finding because the owner disagrees

Answer

Delete the server from the scan scope

Question 4

A CI pipeline blocks a container image because the base layer contains a critical OpenSSL CVE. The application team says the vulnerable binary is not used. What is the BEST next step? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Validate exploitability and rebuild from a patched base image where feasible. Option A is correct because it follows the principle of validating risk before acting. The pipeline blocks the image based on a static scan that flags a CVE, but the application team claims the vulnerable binary is not used. The best next step is to verify exploitability (e.g., by checking if the binary is actually invoked at runtime) and then rebuild from a patched base image if the vulnerability is real. This approach ensures the weakness is addressed without hiding risk, as the rebuild removes the vulnerable component entirely.

Answer

Only rename the image tag

Answer

Ship the image and document nothing

Answer

Ignore all base-image vulnerabilities

Question 5

A cloud posture scan finds a storage bucket with public read access containing customer exports. What should the team do first? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Restrict public access and determine whether sensitive data was accessed. Option C is correct because the immediate priority is to restrict public read access to the storage bucket to stop any ongoing unauthorized data exposure. The team must then determine whether sensitive data was accessed by reviewing access logs (e.g., AWS CloudTrail or S3 server access logs) to assess the scope of the breach. This aligns with incident response best practices: contain the threat first, then investigate.

Answer

Delete all audit logs to reduce liability

Answer

Wait for the next quarterly review

Answer

Rotate database administrator passwords only

Question 6

A vulnerability report has 900 findings. One medium CVSS vulnerability is listed in CISA KEV and has high EPSS; several high CVSS issues are not exploitable in the environment. What should the analyst recommend? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Prioritize the KEV/high-EPSS issue after confirming asset exposure. Option D is correct because the CISA Known Exploited Vulnerabilities (KEV) catalog combined with a high Exploit Prediction Scoring System (EPSS) score indicates active exploitation in the wild, which is a higher priority than static CVSS base scores. The analyst must first confirm that the asset is exposed in the environment before recommending remediation, as a vulnerability that is not exploitable due to compensating controls or network segmentation should not be prioritized. This approach aligns with the NIST SP 800-40 risk-based prioritization framework, which emphasizes threat intelligence over severity alone.

Answer

Remediate only vulnerabilities with vendor logos in the report

Answer

Always sort only by CVSS base score

Answer

Remediate alphabetically by CVE ID

Question 7

Two servers have the same critical vulnerability. One hosts a public payment API; the other is a lab server isolated from production. What changes the remediation priority? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Asset criticality, exposure, and business impact. Option D is correct because remediation priority in vulnerability management is determined by asset criticality, exposure, and business impact, not by superficial attributes. The public payment API server has high business impact and exposure to external threats, making it a higher priority than the isolated lab server, even though both share the same vulnerability. This aligns with risk-based prioritization frameworks such as CVSS environmental metrics and FAIR analysis.

Answer

The number of installed fonts

Answer

The colour of the scanner dashboard

Answer

Whether the hostname is shorter

Question 8

A legacy system cannot be patched because the vendor no longer supports the application. What should the vulnerability manager request? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Documented risk acceptance with compensating controls and a migration/remediation plan. When a legacy system cannot be patched due to vendor end-of-life, the vulnerability manager must formally accept the risk by documenting the risk acceptance, implementing compensating controls (e.g., network segmentation, host-based firewall rules, or application whitelisting), and creating a migration or remediation plan to eventually retire or replace the system. This aligns with the NIST SP 800-53 risk management framework and ensures auditability.

Answer

Give all users local admin rights

Answer

Mark the vulnerability as fixed

Answer

Remove the system from future reports

Question 9

A development team wants to find vulnerable open-source libraries before deployment. Which control best fits this stage? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Software composition analysis in the CI/CD pipeline. Software composition analysis (SCA) is the correct control because it automatically scans the project's dependencies against known vulnerability databases (e.g., NVD, GitHub Advisory Database) to identify vulnerable open-source libraries before deployment. Integrating SCA into the CI/CD pipeline ensures that vulnerabilities are caught early in the development lifecycle, aligning with the shift-left security principle without suppressing or masking risk.

Answer

Wireless spectrum analysis

Answer

Physical badge access reviews

Answer

Database transaction log backups

Question 10

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Authenticated scanning with a test account and session handling. DAST scanners cannot access authenticated pages without valid session credentials. Configuring authenticated scanning with a test account and proper session handling (e.g., via cookies, tokens, or form-based login) allows the scanner to crawl and test behind the login wall, ensuring coverage of all application states. This is the standard remediation for the described limitation.

Answer

Disable all application authentication

Answer

Treat absence of findings as proof of security

Answer

Reduce the scan to only the landing page

Question 11

A CVSS 9.8 vulnerability affects an internal service reachable only from a restricted admin subnet. Which additional analysis is most useful? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Environmental scoring and compensating-control review. Option C is correct because CVSS 9.8 indicates a critical base score, but the actual risk depends on the environment. An environmental score (CVSS v3.1 Environmental Metric Group) adjusts the base score based on modified impact metrics, while a compensating-control review evaluates whether existing controls (e.g., network ACLs, host-based firewalls, or IDS/IPS) reduce exploitability. This analysis prevents unnecessary remediation effort and aligns with the principle of risk-based vulnerability management.

Answer

Change all findings to low severity

Answer

Ignore the vulnerability because it is internal

Answer

Use only the vendor marketing page

Question 12

A team says a critical vulnerability was patched. What should the vulnerability manager require before closure? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

A retest showing the vulnerable condition is no longer present. A retest is required to confirm that the vulnerability has been successfully remediated. Without a retest, the vulnerability manager cannot verify that the patch was applied correctly or that it did not introduce new issues. This aligns with the vulnerability management lifecycle, where closure is only granted after a validated scan or manual test shows the vulnerable condition is eliminated.

Answer

Wait one year before testing

Answer

Create a duplicate ticket for every asset

Answer

Close it immediately based on the email

Question 13

A supplier provides a software product used in a regulated environment. The security team wants visibility into included libraries and versions. What should they request? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

A software bill of materials. A Software Bill of Materials (SBOM) is the correct request because it provides a formal, machine-readable inventory of all included libraries, components, and their versions used in the software product. In a regulated environment (e.g., healthcare, finance), this visibility is essential for vulnerability management, license compliance, and supply chain risk assessment, as mandated by frameworks like NIST SP 800-53 or FDA premarket cybersecurity guidance.

Answer

A building floor plan

Answer

A password complexity screenshot only

Answer

A DNS MX record report

Question 14

A business unit accepts the risk of delaying a patch because downtime would breach a contractual deadline. What should be updated? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

The risk register with owner, justification, expiry date, and compensating controls. Option B is correct because when a business unit accepts the risk of delaying a patch, the risk register must be updated to formally document the risk acceptance. This update should include the risk owner, the business justification for the delay, an expiry date for the exception, and any compensating controls (e.g., network segmentation, enhanced monitoring) that reduce the risk during the gap. This ensures the risk is tracked, reviewed, and eventually remediated, aligning with vulnerability management best practices.

Answer

The phishing training completion list

Answer

The firewall vendor invoice

Answer

The incident containment playbook only

Question 15

A credentialed Linux scan fails on several hosts after SSH hardening. What is the BEST next step? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Review scanner account permissions, allowed authentication methods, and sudo command restrictions. Option B is correct because SSH hardening (e.g., disabling password authentication, restricting ciphers, or enforcing key-based login) often breaks the scanner's ability to authenticate. The best next step is to review the scanner account's permissions, allowed authentication methods (e.g., public key vs. password), and sudo command restrictions to ensure the scanner can still execute the necessary commands for credentialed scanning without compromising security.

Answer

Assume the hosts have no vulnerabilities

Answer

Disable SSH on all servers

Answer

Run only unauthenticated scans forever