Vulnerability Prioritization CS0-003 Practice Questions (Page 5)

Questions 21–24

1. 21application · medium

   A vulnerability scanner reports a critical-severity (CVSS 9.8) remote code execution vulnerability in the web server software running on a legacy internal reporting server. This server is not accessible from the internet, is isolated in a segmented network, and is scheduled for decommissioning in 60 days. The vulnerability has a known public exploit. Which factor should MOST strongly influence the prioritization decision?

   • AThe asset's role as a reporting server, because it likely contains sensitive financial data
   • BThe availability of a public exploit, because it increases the likelihood of exploitation
   • CThe server's lack of internet exposure and short remaining lifespan, because they reduce the practical risk
   • DThe CVSS base score of 9.8, because it represents the intrinsic severity of the vulnerability
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A vulnerability scanner reports a CVSS 9.0 vulnerability in a public-facing web application. The application is a customer portal that handles payment information. The vulnerability is a buffer overflow that requires the attacker to send a specially crafted request. The organization has a WAF that can be configured to block the attack pattern. The team has limited resources and must decide whether to patch the application or configure the WAF. What is the MOST important consideration?

   • AThe asset's value, because the portal handles payment information
   • BThe exploitability of the vulnerability, because it determines the likelihood of attack
   • CThe CVSS score, because it indicates the severity of the vulnerability
   • DThe effectiveness of the WAF in blocking the attack pattern versus the time and effort required to patch
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A zero-day vulnerability is announced in a popular VPN appliance used by an organization. The vendor has not released a patch, and there are reports of active exploitation in the wild. The appliance is used for remote access by all employees. What is the MOST appropriate immediate action?

   • AApply a temporary mitigation, such as restricting access to the VPN appliance from untrusted networks
   • BWait for the vendor to release a patch before taking any action
   • CIgnore the vulnerability because it is a zero-day and no patch is available
   • DDisable the VPN service entirely to prevent exploitation
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which factor is most directly considered when assessing the exploitability of a vulnerability?

   • AThe asset's monetary value to the organization
   • BThe availability of public exploit code or a working exploit
   • CThe age of the vulnerability
   • DThe number of systems affected by the vulnerability
   Reveal Solution Discussion Select an answer first