CS0-003 Vulnerability Management — Timed 40 Questions

Question 1

A vulnerability manager is prioritizing remediation. Which factors should influence risk-based priority? (Choose three.)

Accepted Answer

Internet exposure of the affected asset. Internet exposure of the affected asset is a critical factor because assets reachable from the public internet have a larger attack surface and are more likely to be targeted by automated scanners and exploit kits. Risk-based prioritization weighs the likelihood of exploitation, and an internet-facing system inherently faces a higher threat level than an internal-only asset. This aligns with the CVSS environmental metrics (Modified Attack Vector) and common vulnerability scoring frameworks that adjust severity based on network accessibility.

Answer

Alphabetical order of the CVE identifier

Question 2

Which conditions should push a vulnerability higher in the remediation queue? (Choose three.)

Accepted Answer

The asset supports a critical business process. A is correct because assets supporting critical business processes have a higher impact on organizational operations if compromised. Vulnerability management prioritization frameworks, such as those aligned with the CVSS environmental score, assign greater weight to business criticality. Remediating vulnerabilities on these assets first reduces the risk of significant downtime, data loss, or regulatory non-compliance.

Answer

The CVE number is easy to remember

Question 3

A scanner reports a critical issue on a network device. Which steps help validate the finding before closure? (Choose two.)

Accepted Answer

Confirm the firmware or software version on the device. Option C is correct because confirming the firmware or software version on the device is a critical validation step. The scanner may report a vulnerability based on version detection, but the actual installed version could differ due to patching or backporting. Verifying the exact version ensures the finding is not a false positive before closure.

Answer

Suppress all network-device findings permanently

Answer

Close it because the device is expensive

Question 4

Which items belong in a vulnerability exception request? (Choose three.)

Accepted Answer

Business justification for delayed remediation. A vulnerability exception request is a formal process to accept the risk of not remediating a vulnerability within the standard timeframe. A business justification for delayed remediation is a core component because it documents the operational, financial, or technical reasons why the fix cannot be applied immediately, which is required for risk acceptance by management. Without this justification, the exception lacks the necessary context for approval and audit compliance.

Answer

A request to remove the asset from inventory

Question 5

A web application DAST scan reports stored XSS. Which evidence helps confirm exploitability? (Choose two.)

Accepted Answer

Payload persists and executes when another user views the affected page. Option A is correct because stored XSS is confirmed exploitable only when the injected payload (e.g., ) is persistently stored on the server (e.g., in a database or file) and then rendered and executed in the browser of another user who views the affected page. This demonstrates that the attack can impact victims beyond the tester, proving the vulnerability is not self-inflicted or limited to the attacker's session.

Answer

The server has a large disk

Answer

The application uses HTTPS

Question 6

Which pipeline controls help prevent vulnerable dependencies reaching production? (Choose two.)

Accepted Answer

SBOM generation and review for released builds. A is correct because SBOM (Software Bill of Materials) generation and review provides a detailed inventory of all components in a build, enabling teams to identify and block vulnerable dependencies before release. This aligns with supply chain security best practices, as SBOMs allow automated comparison against vulnerability databases (e.g., NVD) to enforce policy gates early in the pipeline.

Answer

Manual badge checks at the office door

Answer

DNS MX record rotation

Question 7

A vulnerability appears critical but the vulnerable feature is disabled. What should the analyst document before downgrading? (Choose two.)

Accepted Answer

Approval and rationale for the severity change. Option A is correct because when a vulnerability is critical but the vulnerable feature is disabled, the analyst must document the approval and rationale for the severity change to maintain an accurate risk register and audit trail. This ensures that the decision to downgrade is justified, traceable, and compliant with organizational change management policies, preventing arbitrary adjustments that could obscure true risk posture.

Answer

Deletion of the original scanner finding

Answer

The analyst's personal preference for fewer tickets

Question 8

A vulnerability manager wants accurate Linux package findings. Which scan conditions are important? (Choose two.)

Accepted Answer

Authenticated access to inspect installed packages. For accurate Linux package findings, the vulnerability scanner must have authenticated access (e.g., via SSH with valid credentials) to inspect installed packages directly from the package manager database (e.g., RPM or dpkg). Without authentication, the scanner can only perform unauthenticated network-based checks, which cannot reliably determine installed software versions or patch levels. Authenticated access ensures the scanner can execute commands like 'rpm -qa' or 'dpkg -l' to enumerate packages with high accuracy.

Answer

Only scanning ICMP echo replies

Answer

Changing server hostnames randomly

Question 9

An emergency patch may break a revenue-critical system. Which actions balance risk and availability? (Choose two.)

Accepted Answer

Test the patch in a representative staging environment. Option A is correct because testing the emergency patch in a representative staging environment that mirrors the production system's configuration, dependencies, and load allows you to identify potential breaking changes before deployment. This balances risk by validating the patch's impact on revenue-critical systems while maintaining availability, as any failures are contained in the test environment. Option B is correct because applying temporary compensating controls—such as additional monitoring, rate limiting, or failover mechanisms—provides a safety net that reduces the blast radius of a potential patch failure, enabling you to proceed with deployment while preserving system availability.

Answer

Disable monitoring to avoid alerts during the change

Answer

Ignore active exploitation until the next annual review

Question 10

Which findings should be included when reporting remediation performance to asset owners? (Choose two.)

Accepted Answer

Recently remediated findings awaiting validation. Recently remediated findings awaiting validation are a critical metric for asset owners because they confirm that remediation actions have been taken and are pending verification. This aligns with the vulnerability management lifecycle, where validation ensures the fix was applied correctly and no residual risk remains. Including this status in reports provides asset owners with actionable insight into the progress of remediation efforts and any outstanding steps needed to close the finding.

Answer

Every raw scanner debug line

Answer

Unrelated physical-access badge failures

Question 11

A vulnerability scan of a segmented OT network must avoid disrupting fragile devices. Which controls are appropriate? (Choose two.)

Accepted Answer

Use approved safe-check profiles or passive discovery where required. Option A is correct because safe-check profiles (e.g., Nessus 'safe checks' mode) disable active exploits and denial-of-service tests, while passive discovery (e.g., using NetFlow or SNMP traps) never sends packets to fragile OT devices. This prevents disruption to legacy PLCs, RTUs, or other industrial controllers that may crash under aggressive scanning.

Answer

Scan from random external hosts

Answer

Run aggressive exploit checks without approval

Question 12

Which sources improve asset criticality context for vulnerability prioritization? (Choose two.)

Accepted Answer

CMDB or asset inventory with business service mapping. A CMDB or asset inventory with business service mapping provides direct context about which assets support critical business functions, enabling prioritization of vulnerabilities based on potential business impact. This aligns with the FAIR model for risk quantification, where asset criticality is a key factor in determining the likelihood and magnitude of loss.

Answer

Random public IP reputation of unrelated hosts

Answer

Employee lunch preferences

Question 13

A cloud security posture tool reports public access on object storage. Which follow-up checks matter? (Choose two.)

Accepted Answer

Whether sensitive objects were accessed or downloaded. Option B is correct because the primary concern with public access to object storage is data exposure. Checking whether sensitive objects were accessed or downloaded determines if a breach actually occurred, which is a critical follow-up step in vulnerability management. Without this check, you cannot assess the real-world impact of the misconfiguration.

Answer

Whether the storage account name is short

Answer

Whether the administrator uses dark mode

Question 14

Which measures help reduce recurring vulnerabilities from unsupported software? (Choose two.)

Accepted Answer

Lifecycle tracking for end-of-support dates. Lifecycle tracking for end-of-support dates (Option A) is correct because it enables organizations to proactively identify when software will no longer receive security patches. By monitoring these dates, vulnerability management teams can schedule migrations or upgrades before the vendor ceases support, directly reducing the window of exposure to unpatched vulnerabilities. This aligns with the NIST SP 800-53 CM-8 control for configuration management and asset lifecycle tracking.

Answer

Permanent acceptance without review

Answer

Changing scanner colours to red

Question 15

An application has a high CVSS vulnerability, but a WAF rule blocks known exploit payloads. What should the team still do? (Choose two.)

Accepted Answer

Validate the WAF rule against bypass and false-positive risk. A WAF rule blocking known exploit payloads does not guarantee complete protection, as attackers can craft bypass techniques such as encoding, parameter pollution, or using different HTTP methods. Validating the rule against bypass and false-positive risks ensures the WAF is effective without disrupting legitimate traffic, which is critical for maintaining both security and availability.

Answer

Remove the application from vulnerability scans

Answer

Mark the vulnerability as permanently remediated

Question 16

A vulnerability scan identifies a critical unauthenticated remote-code-execution flaw on an internet-facing VPN appliance that is actively exploited in the wild. Several internal-only medium vulnerabilities are also present. What should be remediated first? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Patch or mitigate the VPN appliance immediately and verify exposure is removed. The critical unauthenticated remote-code-execution (RCE) vulnerability on the internet-facing VPN appliance poses an immediate and active threat, as it is being exploited in the wild. According to the CVSS scoring system and industry best practices (e.g., PCI DSS, NIST SP 800-115), vulnerabilities that are remotely exploitable, have high impact, and are actively exploited must be prioritized over internal-only medium-severity issues. Remediating this flaw first reduces the attack surface exposed to the internet and prevents potential compromise of the entire network.

Answer

Start with the oldest medium vulnerability

Answer

Remediate only low-risk internal findings to improve closure rate

Answer

Defer all remediation until the monthly patch window

Question 17

A scan of Windows servers reports few findings, but the scanner used no credentials. The security manager suspects missing patch data. What should be changed? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Run authenticated scans using least-privilege scanner credentials. Unauthenticated scans only enumerate open ports and services visible without credentials, missing the patch status of installed software because they cannot query the Windows registry or WMI for installed updates. Running authenticated scans with least-privilege credentials allows the scanner to log into each target and retrieve detailed patch data via the Windows Update Agent API or registry keys, revealing missing patches that were previously invisible. This directly addresses the security manager's suspicion of missing patch data without introducing unnecessary risk.

Answer

Increase only the port range

Answer

Disable host firewalls permanently

Answer

Trust the unauthenticated result as complete

Question 18

A scanner flags TLS 1.0 on a server, but the service owner says TLS 1.0 is disabled. What is the BEST validation method? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Manually test the service with a TLS client or scanner profile that negotiates protocol versions. Option B is correct because the scanner may have detected TLS 1.0 due to a false positive from a misconfigured cipher suite or a server-side protocol negotiation artifact. Manually testing with a TLS client (e.g., OpenSSL s_client -tls1) or a scanner profile that explicitly negotiates protocol versions provides definitive evidence of whether TLS 1.0 is actually enabled, resolving the discrepancy between the scanner result and the owner's claim.

Answer

Close the finding because the owner disagrees

Answer

Change the severity to informational automatically

Answer

Delete the server from the scan scope

Question 19

A CI pipeline blocks a container image because the base layer contains a critical OpenSSL CVE. The application team says the vulnerable binary is not used. What is the BEST next step? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Validate exploitability and rebuild from a patched base image where feasible. Option B is correct because the best next step is to validate whether the OpenSSL vulnerability is actually exploitable in the context of the application, and if so, rebuild from a patched base image. This balances security with operational efficiency by not blocking the pipeline unnecessarily for unused binaries, while still ensuring that truly exploitable vulnerabilities are remediated. The question asks for the 'BEST next step' for the team, not the scanner configuration, so validating exploitability before acting is the most appropriate response.

Answer

Ship the image and document nothing

Answer

Only rename the image tag

Answer

Ignore all base-image vulnerabilities

Question 20

A cloud posture scan finds a storage bucket with public read access containing customer exports. What should the team do first? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Restrict public access and determine whether sensitive data was accessed. Option C is correct because the immediate priority is to contain the data exposure by restricting public access to the storage bucket, then investigate whether sensitive data was actually accessed by unauthorized parties. This aligns with the vulnerability management principle of 'contain first, investigate second' and addresses the risk of data exfiltration without waiting for a scheduled review or performing unrelated actions.

Answer

Delete all audit logs to reduce liability

Answer

Wait for the next quarterly review

Answer

Rotate database administrator passwords only