A development team is building a new web application. The security team wants to reduce the number of vulnerabilities introduced during development. Which practice is most effective?

Wait for the first vulnerability scan of the production environment.

Conduct a penetration test after the application is deployed.

Integrate static application security testing (SAST) into the CI/CD pipeline.

Require developers to attend a security awareness training once a year.

How are service-level objectives (SLOs) used in vulnerability management?

To replace the need for vulnerability scanners

To define measurable targets for activities like patching and vulnerability scanning

To automatically patch systems without human intervention

To determine the severity of a vulnerability

A security team needs to patch a cluster of application servers that experience peak traffic during business hours. The team has an SLO that requires 99.9% availability monthly. Which approach best aligns with the SLO while ensuring the patch is applied?

Apply the patch during peak hours to ensure the maintenance window is not disrupted.

Defer the patch until the next scheduled maintenance window, even if it is months away.

Patch servers one at a time during a maintenance window, using rolling updates to avoid full cluster downtime.

Patch all servers simultaneously during the maintenance window to complete the process faster.

An organization needs to apply a critical security patch to a production database server. To minimize the impact on users, when should this activity be scheduled?

At a random time chosen by the system administrator

Immediately during peak business hours to ensure rapid protection

During a predefined maintenance window when system usage is low

Only after the system has experienced a security incident

A business unit requests that a security control be waived for a specific application because the control would severely impact performance. What is the most appropriate process for handling this request?

Immediately disable the control to meet the business need

Ask the vendor to provide a custom version of the application

Ignore the request because security controls cannot be waived

Submit a formal exception request that documents the business need and the associated risk

CompTIACySA+

Domain 2Objective 5

Vulnerability Response CS0-003 Practice Questions (Page 4)

Part of the Vulnerability management domain, which accounts for 30% of the CS0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~20–33 in this domain), expect 4–7 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

9concepts

30%of the exam

Questions 16–20

16application · medium
A development team is building a new web application. The security team wants to reduce the number of vulnerabilities introduced during development. Which practice is most effective?
Select an answer first
17foundation · easy
How are service-level objectives (SLOs) used in vulnerability management?
Select an answer first
18application · medium
A security team needs to patch a cluster of application servers that experience peak traffic during business hours. The team has an SLO that requires 99.9% availability monthly. Which approach best aligns with the SLO while ensuring the patch is applied?
Select an answer first
19foundation · easy
An organization needs to apply a critical security patch to a production database server. To minimize the impact on users, when should this activity be scheduled?
Select an answer first
20foundation · easy
A business unit requests that a security control be waived for a specific application because the control would severely impact performance. What is the most appropriate process for handling this request?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CS0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CS0-003” is a trademark of its owner, used for identification only.