Vulnerability Prioritization CS0-003 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A vulnerability scan flags a critical SQL injection vulnerability in a custom web application. The security analyst reviews the finding and discovers the scanner detected the issue by sending a benign test payload that returned an error message containing database syntax. The application's development team states the input is properly parameterized. What should the analyst do NEXT?

   • AReport the vulnerability as confirmed because the scanner produced an error message
   • BValidate the finding manually by sending a crafted payload that attempts to extract actual data
   • CClose the finding as a false positive based on the developer's claim of parameterization
   • DEscalate the finding to management because the CVSS score is critical
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A vulnerability scanner reports a vulnerability with a CVSS vector string: AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N. The vulnerability is found on a developer workstation. The analyst is reviewing the finding. What is the MOST accurate interpretation?

   • AThe vulnerability requires no privileges and can be exploited over the network
   • BThe vulnerability requires local access, high privileges, and user interaction, with low impact
   • CThe vulnerability can be exploited remotely without any user interaction
   • DThe vulnerability has a high impact on confidentiality and integrity
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A zero-day vulnerability is announced in a widely used web server software. The organization uses this software for its public-facing website. The vendor has released a patch, but the organization's change management process requires a 30-day testing period before production deployment. The vulnerability is being actively exploited. What is the BEST course of action?

   • AImplement temporary mitigations, such as a WAF rule, while expediting the change management process
   • BApply the patch immediately, bypassing the change management process
   • CFollow the change management process and wait 30 days before applying the patch
   • DTake the website offline until the patch is applied
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security team has limited resources and must prioritize among three vulnerabilities: (1) a critical CVSS 9.8 vulnerability in an internet-facing web server with a known exploit, (2) a high CVSS 8.1 vulnerability in an internal database that stores customer PII with no known exploit, and (3) a medium CVSS 6.5 vulnerability in a domain controller with a known exploit. The organization is subject to strict data protection regulations. Which vulnerability should be prioritized FIRST?

   • AThe web server, because it has the highest CVSS score and is internet-facing
   • BThe database, because it stores customer PII and is subject to regulations
   • CAll three equally, because each has a known exploit or stores sensitive data
   • DThe domain controller, because compromising it could affect the entire organization
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team discovers a vulnerability in a custom application that requires the attacker to be authenticated as a low-privileged user and to win a race condition. The application is used by only 50 internal employees. The team has limited remediation resources and must decide whether to patch now or defer. What is the MOST important factor in this decision?

   • AThe asset's value, because the application is critical to business operations
   • BThe exploitability requirements, because they significantly reduce the likelihood of exploitation
   • CThe CVSS score, because it is the standard measure of severity
   • DThe number of users (50), because a small user base means lower impact
   Reveal Solution Discussion Select an answer first