What is the primary purpose of threat modeling in the software development process?

To identify and prioritize potential security threats so that mitigations can be designed

To test the application for known vulnerabilities

To ensure that the application meets performance requirements

To document the application's architecture

A vulnerability scanner identifies a critical remote code execution vulnerability in a web server. The vendor has released a security update. What is the most direct action to remediate this vulnerability?

Change the server's IP address to avoid detection

Increase the server's memory to improve performance

Apply the vendor's security patch to the web server

Disable the web server's logging to reduce attack surface

What is the primary role of governance in vulnerability management?

To patch systems as soon as vulnerabilities are discovered

To define the policies, procedures, and responsibilities for managing vulnerabilities

To execute vulnerability scans and analyze results

To purchase and maintain security tools

A security team must patch a critical vulnerability in a server that runs a batch process every night at 2:00 AM. The patch requires a 15-minute restart. The team has a maintenance window from 1:00 AM to 3:00 AM. What is the best time to apply the patch?

At 2:30 AM, during the batch process.

At 1:00 AM, exactly when the maintenance window opens.

At 1:15 AM, after the maintenance window opens and before the batch process starts.

At 3:00 AM, at the end of the maintenance window.

Which of the following best describes the purpose of a compensating control in vulnerability management?

To document the vulnerability for compliance reporting purposes

To eliminate the need for any other security controls in the environment

To permanently remove the vulnerability from the system

To provide an alternative mitigation when the preferred control cannot be implemented

CompTIACySA+

Domain 2Objective 5

Vulnerability Response CS0-003 Practice Questions (Page 1)

Part of the Vulnerability management domain, which accounts for 30% of the CS0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~20–33 in this domain), expect 4–7 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

9concepts

30%of the exam

Questions 1–5

1foundation · easy
What is the primary purpose of threat modeling in the software development process?
Select an answer first
2foundation · easy
A vulnerability scanner identifies a critical remote code execution vulnerability in a web server. The vendor has released a security update. What is the most direct action to remediate this vulnerability?
Select an answer first
3foundation · easy
What is the primary role of governance in vulnerability management?
Select an answer first
4application · medium
A security team must patch a critical vulnerability in a server that runs a batch process every night at 2:00 AM. The patch requires a 15-minute restart. The team has a maintenance window from 1:00 AM to 3:00 AM. What is the best time to apply the patch?
Select an answer first
5foundation · easy
Which of the following best describes the purpose of a compensating control in vulnerability management?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CS0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CS0-003” is a trademark of its owner, used for identification only.