CS0-003 Vulnerability Management Practice Test 8 — 15 Questions

Question 1

A company has implemented a vulnerability management program. The security team needs to ensure that all critical vulnerabilities are remediated within 30 days. Which of the following metrics would BEST measure the effectiveness of this goal?

Accepted Answer

Mean time to remediate critical vulnerabilities. The goal is to ensure all critical vulnerabilities are remediated within 30 days. Mean time to remediate (MTTR) directly measures the average time taken to fix critical vulnerabilities, making it the best metric to assess compliance with the 30-day remediation window. Other metrics, such as detection counts or patch levels, do not capture the timeliness of remediation.

Answer

Number of critical vulnerabilities detected per month

Answer

Number of rescan results showing vulnerability closure

Answer

Percentage of systems with up-to-date patches

Question 2

A security analyst is reviewing the output of a vulnerability scan and notices that a critical vulnerability on a Linux server has been reported as 'Confirmed' by the scanner. The analyst checks the system and finds that the actual vulnerability does not exist because a kernel upgrade was applied via a yum update but the scanner did not detect the change. Which of the following is the MOST likely cause?

Accepted Answer

The scanner was not configured with proper credentials for authenticated scanning. Option C is correct because the vulnerability scanner reported a 'Confirmed' critical vulnerability that no longer exists after a kernel upgrade via yum. This indicates the scanner performed an unauthenticated scan, relying on banner grabbing or service version detection, which cannot verify the actual installed kernel version. With proper credentials (e.g., SSH keys or a service account), the scanner would have performed an authenticated scan, queried the package manager (rpm -q kernel), and correctly identified that the kernel was updated, thus not flagging the vulnerability.

Answer

The vulnerability database was not updated before the scan

Answer

The scanner is configured to alert on missing patches only

Answer

The scanner's plugins for Linux are outdated

Question 3

A security analyst is conducting a vulnerability assessment of a web application. The assessment reveals that the application is vulnerable to SQL injection. Which of the following is the MOST effective remediation?

Accepted Answer

Use parameterized queries in the application code. Parameterized queries (also known as prepared statements) are the most effective remediation for SQL injection because they separate SQL logic from user-supplied data by using placeholders. The database engine treats the input strictly as data, not executable code, which prevents an attacker from altering the query structure. This addresses the root cause at the application layer, unlike other controls that only mitigate or detect the attack.

Answer

Upgrade the web application framework to the latest version

Answer

Deploy a web application firewall (WAF)

Answer

Implement client-side input validation

Question 4

An organization uses automated patch management for workstations but manual patching for servers. After a critical vulnerability is announced, the security team wants to expedite patching for servers. Which of the following is the BEST approach?

Accepted Answer

Test the patch in a staging environment and then deploy. Option A is correct because testing the patch in a staging environment before deploying to production servers validates compatibility and stability, reducing the risk of service disruption. This approach balances the urgency of a critical vulnerability with the need to maintain server availability, which is especially important given that manual patching is the standard procedure for servers. Staging allows the security team to identify any conflicts with existing configurations or dependencies before widespread deployment.

Answer

Disable the affected services until the patch can be applied

Answer

Deploy the patch immediately to all servers

Answer

Implement virtual patching via an IPS

Question 5

During a vulnerability scan, the scanner reports a high number of open ports on a server that is supposed to be a hardened web server. The analyst investigates and finds that the server is running unnecessary services. Which of the following is the MOST effective long-term solution?

Accepted Answer

Implement a configuration management baseline and enforce it. Implementing a configuration management baseline and enforcing it (Option A) is the most effective long-term solution because it ensures that the server is consistently provisioned with only the necessary services and configurations. This approach uses tools like Ansible, Puppet, or Chef to automatically remediate drift, preventing unnecessary services from reappearing after manual changes or reboots. It addresses the root cause by codifying the desired state, rather than relying on ad-hoc fixes.

Answer

Disable the unnecessary services manually

Answer

Increase the frequency of vulnerability scans

Answer

Install a host-based firewall to block the ports

Question 6

A security analyst is prioritizing vulnerabilities for remediation. Which TWO factors should be considered HIGHEST when determining prioritization? (Choose two.)

Accepted Answer

CVSS base score. The CVSS base score provides a standardized, quantitative measure of a vulnerability's severity based on intrinsic characteristics like attack vector and complexity. Prioritizing by CVSS score ensures that remediation efforts focus on vulnerabilities with the highest potential impact, aligning with industry best practices for risk-based vulnerability management.

Answer

Number of false positives associated with the scan

Answer

System owner's preference

Answer

Age of the vulnerability

Question 7

A security analyst has identified a critical vulnerability that affects multiple systems. The analyst needs to report the vulnerability to management. Which THREE elements should be included in the vulnerability report? (Choose three.)

Accepted Answer

Number of affected systems and their criticality. Option A is correct because a vulnerability report must convey the scope and business impact of the issue. Including the number of affected systems and their criticality (e.g., system classification, data sensitivity, or role in the network) allows management to prioritize remediation based on risk exposure. Without this context, management cannot assess the urgency or allocate resources effectively.

Answer

Specific patch installation dates for each system

Answer

Organizational risk appetite

Question 8

A vulnerability assessment has identified multiple issues. Which THREE actions are appropriate steps in the remediation process? (Choose three.)

Accepted Answer

Create a change request to apply the necessary patch or configuration change. Option A is correct because in a structured remediation process, applying a patch or configuration change requires a formal change request to ensure proper testing, approval, and documentation, minimizing the risk of unintended disruptions. This aligns with change management best practices in vulnerability management, where uncoordinated changes can introduce new vulnerabilities or break existing functionality.

Answer

Rescan the system immediately to confirm the vulnerability

Answer

Uninstall the affected software or service to remove the vulnerability

Question 9

A security analyst discovers a server that is missing multiple critical patches. The server hosts a legacy application that cannot be patched immediately due to compatibility issues. Which of the following is the BEST approach to manage the vulnerability risk?

Accepted Answer

Implement network segmentation and increase monitoring. Option B is the best approach because network segmentation isolates the vulnerable legacy server from critical assets, reducing the attack surface, while increased monitoring allows the security team to detect and respond to any exploitation attempts in real time. This balances risk acceptance with active defense, which is a core principle of vulnerability management when patching is not immediately feasible.

Answer

Apply a virtual patch using a WAF

Answer

Disable the server until a patch is available

Answer

Remove the server from the network

Question 10

A vulnerability scan report shows a critical vulnerability on a web server with a CVSS score of 9.8. The IT manager wants to know the risk to the organization. Which of the following factors should the analyst consider FIRST?

Accepted Answer

The asset value and business criticality. The CVSS score of 9.8 indicates a critical severity vulnerability, but risk is a function of both severity and business context. The analyst must first assess the asset value and business criticality of the web server because a critical vulnerability on a non-essential server poses lower risk than the same vulnerability on a server handling sensitive data or core business processes. Without this context, the organization cannot prioritize remediation effectively.

Answer

The vendor's patch release schedule

Answer

The number of exploit attempts in the logs

Answer

The number of other vulnerabilities on the server

Question 11

During a penetration test, an analyst successfully exploits a privilege escalation vulnerability to gain root access on a Linux server. The server is used for application development. Which of the following remediation actions would be MOST effective in preventing similar attacks?

Accepted Answer

Apply the principle of least privilege to user accounts. The principle of least privilege ensures that users and processes have only the minimum permissions necessary to perform their tasks. By applying this to user accounts, the attack surface for privilege escalation is reduced because even if an account is compromised, the attacker cannot easily escalate to root. This directly addresses the root cause of the vulnerability exploited in the scenario.

Answer

Deploy a host intrusion detection system

Answer

Harden the kernel using sysctl parameters

Answer

Implement application whitelisting

Question 12

A vulnerability scanner reports that an internal web application is vulnerable to SQL injection. The development team says they fixed it by input sanitization. Which of the following should the analyst do FIRST?

Accepted Answer

Rescan the application to confirm remediation. Option C is correct because the first step after a claimed fix is to verify the remediation by rescanning the application with the same vulnerability scanner. This provides objective evidence that the SQL injection vector is no longer exploitable, confirming the input sanitization was effective before any further actions are taken.

Answer

Update the vulnerability report

Answer

Perform a manual penetration test

Answer

Review the code changes

Question 13

A company has a policy to remediate vulnerabilities within 30 days. A critical vulnerability is discovered on a database server. The patch requires a reboot, and the database cannot be taken offline during business hours. Which of the following is the BEST approach?

Accepted Answer

Implement a compensating control. Option A is correct because when a critical vulnerability requires a patch that mandates a reboot, but the database cannot be taken offline during business hours, implementing a compensating control (such as network segmentation, strict firewall rules, or an intrusion prevention system (IPS) signature) reduces the risk to an acceptable level until the patch can be applied. This aligns with the 30-day remediation policy by addressing the vulnerability without violating operational constraints.

Answer

Apply a hotfix without reboot

Answer

Schedule the patch during the next maintenance window

Answer

Extend the remediation deadline

Question 14

A vulnerability assessment identifies that an external-facing server has an outdated TLS version configured. The server supports TLS 1.0 and SSL 3.0. Which of the following is the MOST secure configuration change?

Accepted Answer

Enable TLS 1.2 and disable SSL 3.0 and TLS 1.0. Option C is correct because it disables the insecure SSL 3.0 and TLS 1.0 protocols while enabling TLS 1.2, which is currently the most widely supported secure TLS version. TLS 1.2 provides strong cipher suites and has no known practical vulnerabilities like POODLE (SSL 3.0) or BEAST (TLS 1.0). This configuration balances security with compatibility for modern clients.

Answer

Upgrade to TLS 1.3 and disable all others

Answer

Disable TLS 1.0 and keep SSL 3.0

Answer

Disable SSL 3.0 and enable TLS 1.2

Question 15

An analyst is reviewing scan results and finds that a critical vulnerability is present on 50 workstations. The vendor has released a patch, but the IT team is concerned about potential compatibility issues. Which of the following should the analyst recommend?

Accepted Answer

Test the patch on a subset before full deployment. Option B is correct because the IT team's concern about compatibility issues necessitates a controlled rollout. Testing the patch on a subset of workstations allows the analyst to validate that the patch does not break critical business applications or system functionality before full deployment, aligning with the vulnerability management principle of staged patching to minimize operational risk.

Answer

Remove the vulnerable software

Answer

Apply a workaround from the vendor

Answer

Deploy the patch to all workstations immediately