CS0-003 Vulnerability Management Practice Test 6 — 15 Questions

Question 1

A vulnerability scan identifies a critical unauthenticated remote-code-execution flaw on an internet-facing VPN appliance that is actively exploited in the wild. Several internal-only medium vulnerabilities are also present. What should be remediated first? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Patch or mitigate the VPN appliance immediately and verify exposure is removed. The VPN appliance with a critical unauthenticated remote-code-execution flaw that is actively exploited in the wild represents an immediate and severe risk to the organization's security posture. An internet-facing device with such a vulnerability can be compromised by any attacker on the internet without authentication, leading to full system compromise and potential lateral movement into the internal network. Prioritizing remediation of this flaw over internal-only medium vulnerabilities aligns with risk-based vulnerability management principles, as the likelihood and impact of exploitation are far higher.

Answer

Defer all remediation until the monthly patch window

Answer

Start with the oldest medium vulnerability

Answer

Remediate only low-risk internal findings to improve closure rate

Question 2

A scan of Windows servers reports few findings, but the scanner used no credentials. The security manager suspects missing patch data. What should be changed? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Run authenticated scans using least-privilege scanner credentials. Unauthenticated scans rely on network-level probes and can only detect vulnerabilities visible without credentials, such as open ports or banner information. Patch status for Windows servers requires authenticated access to query the registry, WMI, or the Windows Update API. Using least-privilege scanner credentials enables the scanner to perform authenticated checks, revealing missing patches that were previously hidden.

Answer

Trust the unauthenticated result as complete

Answer

Disable host firewalls permanently

Answer

Increase only the port range

Question 3

A scanner flags TLS 1.0 on a server, but the service owner says TLS 1.0 is disabled. What is the BEST validation method? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Manually test the service with a TLS client or scanner profile that negotiates protocol versions. Option D is correct because the best validation method is to manually test the service using a TLS client (e.g., OpenSSL s_client) or a scanner profile that explicitly attempts to negotiate TLS 1.0. This directly verifies whether the server truly rejects TLS 1.0 handshakes, eliminating false positives from scanner misconfiguration or version negotiation quirks. Relying on the owner's assertion or altering the finding without technical proof would violate vulnerability management best practices.

Answer

Close the finding because the owner disagrees

Answer

Change the severity to informational automatically

Answer

Delete the server from the scan scope

Question 4

A CI pipeline blocks a container image because the base layer contains a critical OpenSSL CVE. The application team says the vulnerable binary is not used. What is the BEST next step? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Validate exploitability and rebuild from a patched base image where feasible. Option D is correct because it follows a defensible vulnerability management process: first validate whether the OpenSSL CVE is actually exploitable in the context of the application (e.g., the vulnerable binary may be present but never executed), then rebuild the image from a patched base image to eliminate the risk entirely. This balances security with operational pragmatism, ensuring the pipeline remains secure while avoiding unnecessary delays.

Answer

Ignore all base-image vulnerabilities

Answer

Ship the image and document nothing

Answer

Only rename the image tag

Question 5

A cloud posture scan finds a storage bucket with public read access containing customer exports. What should the team do first? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Restrict public access and determine whether sensitive data was accessed. Option A is correct because the immediate priority is to stop the data leak by restricting public read access to the storage bucket, then investigate whether sensitive data was actually accessed. This aligns with the incident response principle of containment before analysis. In cloud environments like AWS S3 or Azure Blob Storage, a bucket with public read access exposes all objects to the internet, and the first step is to apply a bucket policy or ACL to deny public access.

Answer

Wait for the next quarterly review

Answer

Rotate database administrator passwords only

Answer

Delete all audit logs to reduce liability

Question 6

A vulnerability report has 900 findings. One medium CVSS vulnerability is listed in CISA KEV and has high EPSS; several high CVSS issues are not exploitable in the environment. What should the analyst recommend? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Prioritize the KEV/high-EPSS issue after confirming asset exposure. Option C is correct because it combines threat intelligence (CISA KEV and high EPSS) with environmental context (asset exposure) to prioritize the vulnerability that is actively exploited and likely to be used in attacks, even though its CVSS base score is medium. This aligns with risk-based vulnerability management, which weights exploitability and business impact over raw severity scores.

Answer

Always sort only by CVSS base score

Answer

Remediate alphabetically by CVE ID

Answer

Remediate only vulnerabilities with vendor logos in the report

Question 7

Two servers have the same critical vulnerability. One hosts a public payment API; the other is a lab server isolated from production. What changes the remediation priority? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Asset criticality, exposure, and business impact. Remediation priority is determined by risk, which is a function of asset criticality, exposure, and business impact. The public payment API has high asset criticality (handles sensitive financial data), high exposure (accessible from the internet), and high business impact (breach could cause regulatory fines and revenue loss), whereas the isolated lab server has low exposure and minimal business impact. This aligns with the CVSS environmental score modifiers and NIST SP 800-30 risk assessment methodology.

Answer

The colour of the scanner dashboard

Answer

The number of installed fonts

Answer

Whether the hostname is shorter

Question 8

A legacy system cannot be patched because the vendor no longer supports the application. What should the vulnerability manager request? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Documented risk acceptance with compensating controls and a migration/remediation plan. When a legacy system cannot be patched due to vendor end-of-life, the vulnerability manager must formally document the risk acceptance, implement compensating controls (e.g., network segmentation, host-based firewall rules, or application whitelisting), and create a migration or remediation plan to eventually retire or replace the system. This approach transparently acknowledges the residual risk rather than hiding it, aligning with the principle of risk treatment as defined in NIST SP 800-53 and ISO 27005.

Answer

Mark the vulnerability as fixed

Answer

Remove the system from future reports

Answer

Give all users local admin rights

Question 9

A development team wants to find vulnerable open-source libraries before deployment. Which control best fits this stage? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Software composition analysis in the CI/CD pipeline. Software composition analysis (SCA) is the correct control because it automatically scans the application's dependencies against known vulnerability databases (e.g., NVD, OSS Index) to identify vulnerable open-source libraries. Integrating SCA into the CI/CD pipeline ensures vulnerabilities are caught before deployment, aligning with the 'shift left' security principle. This is the only option that directly addresses the need to find vulnerable open-source libraries at the build stage.

Answer

Database transaction log backups

Answer

Physical badge access reviews

Answer

Wireless spectrum analysis

Question 10

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Authenticated scanning with a test account and session handling. DAST scanners analyze live web applications by sending HTTP requests and inspecting responses. When authentication is required to access protected pages, the scanner must maintain a valid session to reach those endpoints. Configuring authenticated scanning with a test account and proper session handling (e.g., using cookies, tokens, or form-based login) allows the scanner to traverse authenticated pages, ensuring the scan covers the full attack surface and reports findings from restricted areas.

Answer

Reduce the scan to only the landing page

Answer

Disable all application authentication

Answer

Treat absence of findings as proof of security

Question 11

A CVSS 9.8 vulnerability affects an internal service reachable only from a restricted admin subnet. Which additional analysis is most useful? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Environmental scoring and compensating-control review. Option C is correct because CVSS base scores (like 9.8) do not account for network context or existing security controls. Environmental scoring (CVSS Environmental Metrics) adjusts the base score based on factors like asset criticality and network placement, while a compensating-controls review determines whether firewalls, ACLs, or network segmentation already mitigate the risk. This combined analysis provides the true residual risk for business prioritization.

Answer

Ignore the vulnerability because it is internal

Answer

Change all findings to low severity

Answer

Use only the vendor marketing page

Question 12

A team says a critical vulnerability was patched. What should the vulnerability manager require before closure? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

A retest showing the vulnerable condition is no longer present. Option B is correct because the vulnerability manager must obtain objective evidence that the fix was successfully applied and the vulnerability is no longer exploitable. A retest—typically performed via authenticated scanning or manual verification—confirms the absence of the vulnerable condition, aligning with the remediation validation phase in the vulnerability management lifecycle. Closing based solely on a team's email (Option C) violates the principle of verify, not trust, and could leave residual risk unaddressed.

Answer

Create a duplicate ticket for every asset

Answer

Close it immediately based on the email

Answer

Wait one year before testing

Question 13

A supplier provides a software product used in a regulated environment. The security team wants visibility into included libraries and versions. What should they request? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

A software bill of materials. A software bill of materials (SBOM) provides a formal, machine-readable inventory of all components, libraries, and versions used in a software product. This directly gives the security team the visibility needed for vulnerability management in a regulated environment, aligning with frameworks like NIST SP 800-53 and Executive Order 14028.

Answer

A DNS MX record report

Answer

A building floor plan

Answer

A password complexity screenshot only

Question 14

A business unit accepts the risk of delaying a patch because downtime would breach a contractual deadline. What should be updated? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

The risk register with owner, justification, expiry date, and compensating controls. When a business unit formally accepts the risk of delaying a patch, the risk register must be updated with the owner, justification, expiry date, and compensating controls. This documentation ensures the decision is defensible during audits or incidents, as it captures the explicit risk acceptance and the temporary controls in place until the patch is applied.

Answer

The firewall vendor invoice

Answer

The incident containment playbook only

Answer

The phishing training completion list

Question 15

A credentialed Linux scan fails on several hosts after SSH hardening. What is the BEST next step? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Review scanner account permissions, allowed authentication methods, and sudo command restrictions. After SSH hardening, credentialed scans fail because the scanner's authentication method (e.g., password or key-based login) may be blocked, or the scanner account lacks necessary sudo privileges. Option B is correct because reviewing scanner account permissions, allowed authentication methods (e.g., ensuring public key authentication is enabled in sshd_config), and sudo command restrictions directly addresses the root cause of scan failures without compromising security.

Answer

Assume the hosts have no vulnerabilities

Answer

Disable SSH on all servers

Answer

Run only unauthenticated scans forever