CompTIA CySA+ CS0-003 - All Domains Security Operations Vulnerability Management IR

By Jordan Blake · Updated May 25, 2026

Questions25
Passing Score75%
Format100% Multiple Choice
Sessions Logged1,656
Your progressLog in / Register to track times taken, best score, questions mastered, and coverage on this quiz.
Rating
4.7 (39)

Topics covered

This quiz

Uncategorized25 (100%)

Uncategorized25 questions

Browse more · Report this quiz

Question catalog for this preview

Catalog listing of the 5 preview questions for this quiz.

Question 1

A vulnerability assessment reveals a server running software with a CVSS base score of 7.5. However, a threat intelligence feed indicates this CVE is being actively exploited in the wild by nation-state actors targeting your industry. How does this intelligence affect prioritization?

Answer choices

  • A. It doesn't change prioritization — CVSS base score is the only factor

  • B. Active exploitation by relevant threat actors significantly elevates the urgency — this should be treated as critical and remediated immediately

  • C. It lowers the priority because other organizations are already being attacked

  • D. CVSS scores already incorporate threat intelligence

Question 2

A SOC analyst receives a SIEM alert for a successful brute-force login to an admin account. The login came from an IP address in Russia, while the legitimate admin works from the US. Which action should the analyst take FIRST?

Answer choices

  • A. Email the admin to verify if they are traveling

  • B. Immediately disable the admin account, preserve logs, and initiate the incident response process

  • C. Block the Russian IP address in the firewall

  • D. Wait for another alert before acting

Question 3

An analyst is reviewing a vulnerability scan report. A critical vulnerability (CVSS 9.8) is found on a server with no internet access, protected by a firewall, requiring authenticated access from an IP-restricted management VLAN. What should the analyst recommend?

Answer choices

  • A. Patch the vulnerability immediately regardless of context

  • B. Apply the patch in the next scheduled maintenance window — environmental controls reduce the exploitability score, but the vulnerability should still be remediated

  • C. Remove the vulnerability from the report

  • D. Accept the risk permanently with no action needed

Question 4

A security analyst is investigating a compromise and runs the command `netstat -ano` on a Windows system. What information does this provide for the investigation?

Answer choices

  • A. List of all installed programs

  • B. All active TCP/UDP connections with process IDs (PIDs), enabling correlation of suspicious connections to specific processes

  • C. All open files on the system

  • D. All logged-in users

Question 5

An analyst wants to understand the scope of a potential insider threat by analyzing which files a specific user accessed over the past 30 days. Which data source is MOST relevant?

Answer choices

  • A. Network flow data (NetFlow)

  • B. Windows Security Event Log (Event ID 4663 — object access audit events)

  • C. DHCP logs

  • D. DNS query logs