Examworthy
Open the appSign inStart free

CS0-004 domain - 26% of the exam

Vulnerability Management

Vulnerability Management is 26% of the CS0-004 exam. These are the objectives it covers, each with practice questions, with every answer explained.

The domain in numbers

81
Practice questions
4
Objectives
39
Medium
42
Hard

Where people go wrong

  • Treating the CVSS base score as the priority

    The highest base score looks like the first thing to fix, but base score alone ignores whether a flaw is actually being exploited or how exposed the asset is. In these questions a lower-scored finding on an internet-facing, actively exploited, or business-critical asset outranking a higher-scored finding on an isolated or low-value one. Exposure and exploitability set the remediation order.

    See it in a sample question

  • Confusing EPSS, CVSS, and KEV

    EPSS, CVSS, and the CISA Known Exploited Vulnerabilities catalogue answer different questions, and the wrong options in these questions swap their roles. The CVSS base score rates a flaw's intrinsic severity. EPSS estimates the probability it will be exploited. KEV lists vulnerabilities with confirmed active exploitation.

    See it in a sample question

  • Swapping CVSS's own Base, Temporal, and Environmental groups

    Even within CVSS alone, the three metric groups get swapped. The Base group is the fixed, environment-independent severity. The Temporal group covers factors that change over time, such as exploit maturity. The Environmental group is what an analyst adjusts for their own deployment and security requirements. Each wrong option attaches a group's description to a different group.

    See it in a sample question

  • Reversing false positive and false negative

    These two terms get swapped in both directions. A false positive is a reported finding that validation shows is not really there, which wastes effort such as remediation hours spent patching a service that was already up to date. A false negative is a real weakness the scan missed entirely, which is the more dangerous outcome because nobody is ever alerted to fix it. Each wrong option applies one term to the situation the other describes.

    See it in a sample question

  • Mixing up static and dynamic application testing

    SAST and DAST are told apart by whether the application is running. SAST reads source or compiled code and needs no running instance. DAST sends crafted input to a live, deployed application and observes the response. The wrong options in these questions attach source-reading behaviour to DAST or live-request behaviour to SAST, reversing which tool needs the application running.

    See it in a sample question

Objectives in this domain

What to study

The official documents this domain's practice questions cite most.

  • CVSS v3.1 specificationcited by 6 questions
  • CISA Known Exploited Vulnerabilities cataloguecited by 4 questions
  • Agent-based versus agentless scanningcited by 3 questions
  • Credentialed versus non-credentialed scanningcited by 3 questions
  • FIRST CVSS v3.1 specificationcited by 3 questions
  • FIRST EPSS modelcited by 3 questions
  • SAST versus DASTcited by 3 questions
  • Active versus passive scanningcited by 2 questions

Sample questions from this domain

Free sampleVulnerability Managementhard

A scanner reports three findings on assets scheduled for this week's patch window. Which finding should the analyst escalate as the top priority?

1) Internet-facing VPN gateway  CVSS 9.8  EPSS 0.94  on CISA KEV
2) Internal file server        CVSS 9.8  EPSS 0.02  not on KEV
3) Isolated lab workstation    CVSS 10.0 EPSS 0.01  not on KEV
  • AFinding 2, because an internal file server holds sensitive data and shares the same 9.8 base score.
  • BFinding 3, because its CVSS base score of 10.0 is the highest of the three findings.
  • CFinding 1, because it is internet-facing, has a high probability of exploitation, and appears on the KEV catalogue. Correct
  • DAll three equally, because every finding exceeds a CVSS base score of 9.0.
Prioritise vulnerabilities using exploitability and exposure, not base score alone, when several findings share a high CVSS. Risk-based prioritisation weighs likelihood and impact together: EPSS estimates the probability of exploitation and KEV confirms it is happening in the wild, so an internet-facing KEV-listed flaw outranks equally-scored but unexploited internal or isolated findings.

Why A is wrong: The shared base score is tempting, but a very low EPSS and no KEV listing mean exploitation is unlikely, and internal exposure is lower than an internet-facing gateway.

Why B is wrong: The maximum base score draws the eye, but an isolated lab workstation with negligible EPSS and no KEV entry poses little practical risk, so base score alone must not drive the decision.

Why C is correct: The VPN gateway combines high exposure, a high EPSS score, and confirmed active exploitation on KEV, so it carries the greatest real-world risk despite an equal base score to finding 2.

Why D is wrong: Treating high base scores as interchangeable ignores exploitability and asset context, which are exactly what separate these three findings by real risk.

Free sampleVulnerability Managementhard

How does the EPSS score differ from a CVSS base score when used to prioritise vulnerabilities?

  • AEPSS measures the technical severity of a flaw, whereas CVSS estimates how soon a patch will be released.
  • BEPSS estimates the probability that a vulnerability will be exploited, whereas CVSS base scores rate its intrinsic severity if exploited. Correct
  • CEPSS is a confirmed list of exploited flaws, whereas CVSS predicts which flaws will be exploited next.
  • DEPSS is set individually by each organisation, whereas CVSS base scores are recalculated for every environment.
Explain that EPSS estimates exploitation likelihood while a CVSS base score expresses intrinsic severity, making them complementary inputs. EPSS uses observed threat data to output a probability of exploitation, a different question from the CVSS base score, which quantifies how damaging and how exploitable a flaw is by its intrinsic characteristics.

Why A is wrong: This reverses both concepts; severity is the domain of CVSS and patch timing is measured by neither metric.

Why B is correct: Correct: EPSS is a data-driven likelihood-of-exploitation estimate, while the CVSS base score rates impact and exploitability characteristics assuming exploitation occurs.

Why C is wrong: A confirmed exploited-in-the-wild catalogue describes CISA KEV, not EPSS, and CVSS makes no exploitation prediction at all.

Why D is wrong: This inverts the truth: EPSS is a published global model and the CVSS base score is the environment-independent portion that organisations do not recalculate.

Free sampleVulnerability Managementhard

Within the CVSS version 3.1 framework, what does the Environmental metric group allow an analyst to do that the Base metric group alone cannot?

  • AAdjust the score to reflect the security requirements and modified characteristics of the analyst's own deployment. Correct
  • BReflect the current maturity of available exploit code and the state of official remediation.
  • CExpress the intrinsic severity of the flaw independent of any particular organisation or time.
  • DPredict the probability that the vulnerability will be exploited in the wild within thirty days.
Distinguish the CVSS Environmental metric group as the mechanism for tailoring a base score to local asset context and security requirements. The Environmental group applies modified base metrics and confidentiality, integrity and availability requirement weightings so the final score represents risk to the specific environment rather than the flaw in the abstract.

Why A is correct: Correct: the Environmental group re-weights confidentiality, integrity and availability requirements and lets the analyst override base metrics to match how the asset is actually deployed.

Why B is wrong: Tempting because these do adjust a score over time, but exploit maturity and remediation level belong to the Temporal metric group, not the Environmental group.

Why C is wrong: This describes the purpose of the Base metric group itself, which is the fixed starting point the Environmental group is meant to tailor.

Why D is wrong: Exploitation probability is what EPSS estimates; CVSS environmental scoring measures contextual impact, not likelihood of attack over a time window.

Free sampleVulnerability Managementhard

When reviewing scanner output, an analyst wants to describe a finding where the tool reported a vulnerability that manual testing proves does not actually exist on the host. Which term correctly names this result?

  • AFalse negative, because the tool failed to report a vulnerability that is genuinely present on the target
  • BFalse positive, because the tool raised a finding that validation shows is not truly present on the target Correct
  • CTrue positive, because the tool correctly reported a vulnerability that validation later confirms as real
  • DInformational finding, because the tool listed an observation that carries no security severity rating
Identify a false positive as a scanner finding that validation proves is not actually present on the target. A false positive occurs when the scanner's signature or version check triggers on a condition that does not correspond to a real, exploitable weakness, so validation is what distinguishes it from a true positive.

Why A is wrong: This is tempting because it is the paired error term, but a false negative is a missed real vulnerability, the opposite of a reported-but-absent one.

Why B is correct: A false positive is a reported condition that turns out not to be real once the analyst validates it, which is exactly what the stem describes.

Why C is wrong: The wording sounds authoritative, but a true positive is a correctly reported real finding, whereas the stem states manual testing disproves it.

Why D is wrong: Informational entries are low-severity notes rather than validation errors, so this mislabels the mismatch between report and reality.

Free sampleVulnerability Managementmedium

A CI pipeline runs a scanner against the source repository of a web application before each build. It reports a SQL injection risk by pointing at a specific line where user input is concatenated into a query, but it never sends a request to the running application. The team asks the analyst what class of tool produced this finding. Which BEST describes it?

Pipeline stage: pre-build code analysis
Finding: 'Tainted input reaches SQL query construction'
Location: src/dao/UserDao.java:142
Target: source code (application not deployed)
  • ADynamic application security testing, because it exercised the running application and observed the injection response.
  • BPassive network scanning, because it monitored the build traffic and inferred the flaw from observed requests.
  • CCredentialed host scanning, because it logged into the build server to read the application's configuration files.
  • DStatic application security testing, because it inspected the source code and traced tainted input to a vulnerable query without executing the application. Correct
SAST analyses application source code without executing it, tracing data flows to flaws such as injection at a specific line. Static application security testing examines source or byte code at rest and follows tainted input through the code to a sink such as a query builder. Because it reports a file and line with no deployed application, the tool is SAST, not the runtime-based DAST.

Why A is wrong: Tempting because SQL injection is a classic dynamic-test finding, but the tool never sent a request to a running app, so it cannot be DAST.

Why B is wrong: Tempting because both avoid probing a live target, but passive scanning reads network traffic, whereas this tool read source files, so the category is wrong.

Why C is wrong: Tempting because it runs inside the pipeline, but a credentialed host scan checks patch and configuration state, not source-level data flow to a query, so it does not match the finding.

Why D is correct: Correct: analysing source and citing a line and file with no running instance is the defining behaviour of SAST, which examines code at rest rather than a live application.

Other domains in this exam

See also the CS0-004 cert hub, the study guide, and the cheat sheet.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.