CS0-003 Practice Question: Which three of the following are key…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Establishing a remediation prioritization framework based on asset criticality and exploitability

  Why this is correct

  A remediation prioritization framework is essential because it translates raw scan results into actionable risk decisions. By weighing each finding against the asset's criticality to mission operations and the likelihood of exploitation, security teams can allocate limited resources to mitigate the most dangerous vulnerabilities first, rather than applying uniform patches across the environment. This approach directly supports risk-based vulnerability management, which is a core tenet of the CySA+ methodology.

• ✗

  Scanning all assets with the highest possible scan intensity to ensure no vulnerability is missed

  Why it's wrong here

  While comprehensive scanning is important, forcing the highest possible scan intensity on every asset is counterproductive. Such aggressive scanning can overwhelm network bandwidth, trigger intrusion prevention safeguards, or crash fragile production services, and often generates a high volume of false positives that dilute analyst attention. A key consideration is balancing scan thoroughness with operational stability, not simply maximizing technical intensity.

• ✓

  Integrating threat intelligence feeds to contextualize vulnerabilities and focus on active threats

  Why this is correct

  Threat intelligence feeds add crucial context to vulnerability data by identifying which CVEs are actively exploited in the wild or targeted by known adversary groups. This enables defenders to exclude theoretical or low-risk weaknesses and instead focus prioritization on vulnerabilities that pose immediate, demonstrated danger to the organization. Integrating these feeds is a key consideration because it moves vulnerability management from a generic patch list to a threat-informed defense.

• ✗

  Performing vulnerability scans only during off-peak hours to minimize network disruption

  Why it's wrong here

  Limiting scanning to off-peak hours entirely ignores assets that are only active or reachable during business hours, such as work-from-home endpoints, cloud-based development instances, or time-sensitive OT equipment. While scheduling scans to ease network congestion is a reasonable operational choice, it should not be the sole determinant; continuous or staggered scanning is often needed to maintain coverage of a dynamic enterprise environment. Thus, this is a scheduling tactic, not a foundational design principle.

• ✓

  Defining a formal remediation SLA that aligns with organizational risk tolerance

  Why this is correct

  A formal remediation SLA, with different time frames for critical, high, medium, and low severity findings, imposes managed accountability and aligns mitigation speed with the organization's tolerance for exposure. This establishes clear expectations for operations owners and security, ensuring that the most severe vulnerabilities are closed before attackers can exploit them. Defining such SLAs is a key governance step in implementing an effective vulnerability management program.

• ✗

  Using default scan credentials from the vulnerability scanner vendor for consistency

  Why it's wrong here

  Default vendor credentials are typically low-privilege, read-only accounts that cannot access registry keys, custom application configurations, or other sensitive data needed for authenticated scanning. Using them produces misleading results that understate risk, and they also create a security risk because the credentials are publicly known and could be leveraged by attackers if left configured. A key implementation consideration is to use dedicated, least-privilege, domain-specific accounts with appropriate access to enable accurate and safe authenticated scans.

Go deeper

Related to this question