An organization wants to ensure that vulnerability management activities are consistent and aligned with business objectives. Which of the following is the primary mechanism for achieving this?

Deploying a firewall at the network perimeter

Establishing governance policies and procedures for vulnerability management

Hiring more security analysts to perform manual scans

Purchasing the most expensive vulnerability scanner available

During which phase of the software development life cycle (SDLC) should security requirements be first considered to prevent vulnerabilities?

Requirements gathering and design

A security analyst discovers that a web server has a vulnerable version of OpenSSL installed because a previous administrator manually updated the library without updating the configuration baseline. The analyst wants to prevent this from recurring. Which action is the most effective?

Disable the OpenSSL module in the web server configuration.

Create a security exception for the web server to allow the vulnerable version.

Update the configuration baseline to include the patched OpenSSL version and enforce it via configuration management.

Add a manual step to the patching runbook to update OpenSSL after each patch cycle.

A development team is using an agile methodology with frequent releases. The security team wants to integrate security into the SDLC without slowing down development. Which practice is most effective?

Integrate SAST and dependency scanning into the CI/CD pipeline.

Wait for the annual security assessment to identify vulnerabilities.

Require a manual security review by a security architect for every code change.

Conduct a full penetration test before every release.

What is the primary purpose of a maintenance window in vulnerability management?

To provide a backup of critical data

To allow users to report security issues

To increase the frequency of vulnerability scans

To perform system updates and patches with minimal disruption to business operations

CompTIACySA+

Domain 2Objective 5

Vulnerability Response CS0-003 Practice Questions (Page 6)

Part of the Vulnerability management domain, which accounts for 30% of the CS0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~20–33 in this domain), expect 4–7 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

9concepts

30%of the exam

Questions 26–30

26foundation · easy
An organization wants to ensure that vulnerability management activities are consistent and aligned with business objectives. Which of the following is the primary mechanism for achieving this?
Select an answer first
27foundation · easy
During which phase of the software development life cycle (SDLC) should security requirements be first considered to prevent vulnerabilities?
Select an answer first
28application · medium
A security analyst discovers that a web server has a vulnerable version of OpenSSL installed because a previous administrator manually updated the library without updating the configuration baseline. The analyst wants to prevent this from recurring. Which action is the most effective?
Select an answer first
29expert · hard
A development team is using an agile methodology with frequent releases. The security team wants to integrate security into the SDLC without slowing down development. Which practice is most effective?
Select an answer first
30foundation · easy
What is the primary purpose of a maintenance window in vulnerability management?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CS0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CS0-003” is a trademark of its owner, used for identification only.