CS0-003: Vulnerability Management
Vulnerability Management is one of the skill areas tested on the CySA+ (Cybersecurity Analyst) (CS0-003) exam. Below are free CS0-003 practice questions with worked answers and a concept diagram — each with a plain-language explanation. Practice the first 10 questions of CS0-003 free, no signup.
The concept, in one picture
3 free CS0-003 Vulnerability Management questions
A vulnerability analyst at a payment-processing startup is triaging a newly disclosed flaw that is being exploited in the wild. Advisories state that it is exploitable remotely over the internet with low attack complexity, requires no privileges and no user interaction, and results in a full loss of confidentiality and integrity but has no effect on availability. Which of the following CVSS 3.1 base vectors correctly represents this vulnerability?
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
- CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
- ✓ CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Work through each metric in the description: remotely exploitable over the internet = AV:N, low complexity = AC:L, no privileges = PR:N, no user interaction = UI:N, full confidentiality and integrity loss = C:H/I:H, and no availability effect = A:N. Only one vector matches all of them. The first option is wrong because PR:L and UI:R contradict 'no privileges and no user interaction.' The second is wrong on nearly every axis: AV:A means adjacent-network only, AC:H means high complexity, and C:L/I:L/A:H inverts the stated impacts. The last option matches the exploitability metrics but claims A:H, a high availability impact, when the advisory says availability is unaffected.
A security analyst at a regional hospital is preparing a remediation plan for the latest vulnerability scan results. Nearly every affected host can be patched during the monthly change window with a single reboot. The exception is a pair of medical imaging workstations that run on a sealed, vendor-managed appliance the hospital has no administrative access to. Which of the following inhibitors to remediation best describes the situation with the imaging workstations?
- Absence of an approved maintenance window
- Legacy platforms that are past end of life
- ✓ Proprietary vendor-controlled systems
- Operating systems no longer supported by the publisher
The imaging workstations sit on a closed appliance that only the vendor can modify — the hospital simply has no access to patch them. That is the textbook definition of a proprietary system acting as an inhibitor to remediation. A maintenance window is not the problem, since the organization already has a monthly change window and downtime is achievable. Nothing in the scenario says the platforms are end of life (legacy) or that their operating systems have lost publisher support — the blocker is access, not age or support status.
A retail chain is extending its established vulnerability management program as it migrates part of its data center into an IaaS provider, creating a hybrid environment. Which of the following implications of the move should the vulnerability management team take into account?
- Traditional network scanners are incapable of assessing any IaaS-hosted workloads
- ✓ The scanners already in place may fail to detect cloud-specific misconfigurations, such as publicly exposed storage buckets or overly permissive IAM policies
- Under the shared responsibility model, the provider handles vulnerability scanning of tenant guest operating systems
- Scans of cloud-hosted assets are only reliable when launched from inside the provider's own network
Conventional vulnerability scanners were built to find missing patches and CVEs on hosts and network devices; they generally have no visibility into the cloud control plane, so issues like open storage buckets, exposed management APIs, or over-broad IAM roles can slip past them — which is why cloud security posture management (CSPM) tooling exists. The claim that scanners cannot assess IaaS workloads at all is wrong: IaaS VMs are customer-managed and can be scanned with agents or authenticated scans much like on-prem servers. Under shared responsibility for IaaS, the guest OS and everything above it are the customer's job to scan, not the provider's. And scan origin is flexible — scans can legitimately run from on-prem, from agents, or from cloud-hosted scanners; there is no rule requiring them to originate inside the provider's network.
Practice CS0-003 free
The first 10 questions of every exam are free. No signup, no email wall.
Start practicing →Get a free CS0-003 study plan by email
A short plan to work through CS0-003 by skill area, plus a note when we add new questions. Optional — the practice above stays free. No spam, unsubscribe anytime.