Vulnerability Prioritization CS0-003 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A vulnerability scanner reports a medium-severity vulnerability in a web application that is behind a web application firewall (WAF). The analyst reviews the finding and notes the scanner detected the vulnerability by sending a payload that was blocked by the WAF. The application is not accessible from the internet. What should the analyst do?

   • AValidate the finding by testing the application directly, bypassing the WAF
   • BClose the finding as a false positive because the WAF blocked the payload
   • CReport the vulnerability as confirmed because the scanner detected it
   • DEscalate the finding to management because it is a web application vulnerability
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which asset would typically be considered of highest value in a vulnerability prioritization decision?

   • AA database server containing customer personally identifiable information (PII)
   • BA development workstation used by a junior developer
   • CA public web server hosting the company's marketing site
   • DA printer on the office network
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A vulnerability has a CVSS base score of 9.8. How should a security analyst interpret this score?

   • AThe vulnerability is high severity and requires prompt attention.
   • BThe vulnerability is critical severity and should be prioritized for remediation.
   • CThe vulnerability is medium severity and should be monitored for changes.
   • DThe vulnerability is low severity and can be addressed during routine maintenance.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An organization has a vulnerability with a CVSS score of 7.5 on a server that hosts a public-facing marketing website. The same vulnerability is also present on an internal server that hosts the company's proprietary source code repository. Both servers are equally accessible to attackers (the marketing server is internet-facing, the source code server is on the internal network but accessible to all employees). The organization has limited resources. Which server should be prioritized?

   • AThe marketing server, because it is more likely to be attacked
   • BThe marketing server, because it is internet-facing
   • CBoth equally, because they have the same CVSS score
   • DThe source code server, because the source code is a critical business asset
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team is assessing a zero-day vulnerability in a network device. The vulnerability requires the attacker to have physical access to the device. The device is located in a locked data center with restricted access. The vendor has not released a patch. What is the MOST appropriate prioritization?

   • AMedium priority, because the device is a network device
   • BLow priority, because physical access is required and the device is in a restricted area
   • CImmediate priority, because there is no patch available
   • DHigh priority, because it is a zero-day vulnerability
   Reveal Solution Discussion Select an answer first