Vulnerability Response CS0-003 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A development team is designing a new payment processing system. The security team wants to identify potential threats and design mitigations before coding begins. Which activity is most appropriate?

   • AWait for the results of the first penetration test.
   • BDeploy a web application firewall in front of the system.
   • CConduct a threat modeling session using STRIDE.
   • DRun a vulnerability scanner against the development environment.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst discovers a critical vulnerability in a legacy application that cannot be patched. The application is used by a small team and is not internet-facing. The analyst proposes a compensating control. Which control is most appropriate?

   • AMove the application to a public cloud to improve security.
   • BRequest an exception and accept the risk.
   • CDisable the application until a patch is available.
   • DRestrict access to the application to only the required team members via network segmentation and firewall rules.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security team must patch a critical vulnerability in a customer-facing application. The application has an SLO of 99.99% availability, which allows only about 4 minutes of downtime per month. The patch requires a 15-minute restart. What is the best approach to meet the SLO?

   • AApply the patch to a single instance and let the load balancer route around it.
   • BDefer the patch until the next major release that includes the fix.
   • CDeploy the patch to a staging environment, then fail over traffic to a patched instance and update the original.
   • DApply the patch during the maintenance window and accept the 15-minute outage.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security team is overwhelmed by the number of vulnerabilities reported by scanners. The team spends most of its time on low-risk findings and misses critical patches. Management wants to improve the effectiveness of the vulnerability management program. Which action is the most aligned with governance principles?

   • AAutomatically patch all vulnerabilities as soon as they are discovered.
   • BEstablish a risk-based prioritization policy that defines criteria for severity, exploitability, and asset criticality.
   • CGrant exceptions for all low-risk vulnerabilities to reduce the workload.
   • DIncrease the frequency of vulnerability scans to catch more issues.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security analyst discovers a critical vulnerability in a legacy system that cannot be patched. The system is isolated and monitored, but management wants to accept the risk. The analyst must ensure the exception is properly documented. Which element is most important to include in the exception?

   • AThe name of the system owner and the date the vulnerability was discovered.
   • BA statement that the vulnerability is not exploitable in the isolated environment.
   • CA signed approval from the CISO and the cost of the compensating controls.
   • DA detailed description of the compensating controls and a review date.
   Reveal Solution Discussion Select an answer first