CS0-004 Questions 21-30: Vulnerability Assessment and Risk

CompTIA CySA+ CS0-004 includes Vulnerability Management, worth 26% of the exam. This domain tests how analysts select assessments, interpret findings, and reduce risk using asset and threat context. These CS0-004 vulnerability assessment questions cover scan planning, assessment tools, prioritization, and remediation validation.

This is the third set in our CompTIA CySA+ CS0-004 series (Questions 21-30). It follows CS0-004 Questions 11-20 on threat hunting and SOC reporting. Every question is an original practice scenario mapped to the official exam objectives, not a copy of a real exam item.

Match each assessment to the evidence you need and the disruption you can tolerate. A severity score alone does not tell you which vulnerable asset presents the greatest immediate business risk.

Question 21: Preparing the Scan Scope

A company acquires a small business and approves vulnerability scanning of its production network. The inherited asset list is incomplete, and no scan has started. The analyst must avoid missing production systems or testing devices outside the approved scope. Which sequence best prepares the assessment?

A) Select a scan profile, scan the old list, then identify owners.

B) Reconcile the inventory, confirm scope, then plan approved scans.

C) Scan adjacent networks, extend scope, then update the inventory.

D) Patch the listed devices, close findings, then discover new assets.

👁 Reveal Answer

Correct Answer: B

Explanation: B establishes what assets exist and which ones the assessment may test before selecting operational scan settings. The incomplete inventory makes coverage and authorization the deciding constraints. A relies on the known-incomplete list and delays ownership checks. C tests adjacent networks before confirming permission. D begins remediation without establishing assessment coverage or findings. Scan planning should also account for scheduling, performance, sensitivity, and segmentation rather than treating every discovered device identically.

Reference: CompTIA CySA+ CS0-004 exam objectives, 2.1: Asset inventory and planning considerations

Question 22: Visibility Inside a Server

An external scan reports reachable services on a server. The assessment now requires evidence of installed patches and local configuration, not just what an unauthenticated network client can observe. The owner permits an approved account with the access required by the scanner. Which method best meets the new requirement?

A) Repeat a non-credentialed scan from another external network.

B) Repeat a discovery scan against the server’s adjacent subnet.

C) Analyze passive network traffic from the server’s uplink.

D) Run a credentialed assessment with the approved scan account.

👁 Reveal Answer

Correct Answer: D

Explanation: D uses authorized authenticated access to inspect the local information the assessment needs. The account must have the scanner’s required access, and successful authentication should be verified. A still observes the server without that local access. B discovers nearby devices rather than examining this server’s installed patches. C observes communications, which do not provide a complete local patch and configuration assessment. Credentialed scanning improves the relevant visibility but does not guarantee every possible weakness will be found.

Reference: CompTIA CySA+ CS0-004 exam objectives, 2.1: Credentialed versus non-credentialed scanning

Question 23: Assessing a Fragile Production Segment

A manufacturing site’s operational technology owner prohibits probe traffic to production controllers during the current shift. The analyst has an approved mirrored traffic feed and must begin identifying devices and observed communications without sending packets to those controllers. Which assessment approach fits the restriction?

A) Passively analyze traffic from the approved mirrored feed.

B) Actively scan controller services at a reduced packet rate.

C) Authenticate to each controller to inspect its configuration.

D) Send discovery probes only to unfamiliar controller addresses.

👁 Reveal Answer

Correct Answer: A

Explanation: A observes existing traffic instead of generating assessment traffic toward the controllers. It respects the explicit operational restriction while providing evidence about devices that communicate on the monitored segment. B still sends active probes, even at a slower rate. C introduces connections to controllers that the current authorization does not allow. D also sends probes and does not become passive because it targets fewer addresses. Passive visibility is limited to what the feed exposes; it is not proof of complete vulnerability coverage.

Reference: CompTIA CySA+ CS0-004 exam objectives, 2.1: Passive versus active scanning, operations, and sensitivity

Question 24: Checking an Approved Build Standard

A server passes its missing-patch checks, but an auditor needs evidence that its security settings match the company’s approved CIS benchmark profile. The analyst must assess configuration compliance without replacing that profile with a different standard. Which next assessment is the most direct fit?

A) Run a discovery scan that maps the server’s reachable ports.

B) Run a web scan that tests the server’s application inputs.

C) Run a baseline scan using the approved CIS benchmark profile.

D) Run a packet review that summarizes the server’s connections.

👁 Reveal Answer

Correct Answer: C

Explanation: C compares the relevant security settings with the specified baseline. The question requires configuration compliance evidence, not another general view of exposure. A identifies reachable services but does not establish that all required settings match the benchmark. B assesses web application behavior rather than the server’s approved build profile. D describes observed communications instead of checking configuration requirements. A clean patch report and a compliant baseline are different findings; neither automatically establishes the other.

Reference: CompTIA CySA+ CS0-004 exam objectives, 2.1: Security baseline scanning and CIS benchmarks

Question 25: Selecting an Application Assessment Tool

A team authorizes testing of a running customer portal in staging. The analyst needs a web application scanner to assess HTTP requests and responses, rather than a tool focused on network mapping or cloud infrastructure. Which tool is the most direct match among these choices?

A) Masscan with an approved target list.

B) Zed Attack Proxy with an approved test scope.

C) ScoutSuite with an approved assessment scope.

D) Angry IP Scanner with an approved target list.

👁 Reveal Answer

Correct Answer: B

Explanation: B belongs to the web application scanner category named in the objectives and matches the authorized application-level assessment. A focuses on network scanning and mapping, not the requested web assessment. C belongs to cloud infrastructure assessment, which addresses a different layer. D supports network discovery rather than direct assessment of the portal’s application behavior. The tool selection does not authorize unrestricted testing; the analyst should still use the staging scope and approved testing limits.

Reference: CompTIA CySA+ CS0-004 exam objectives, 2.2: Web application scanners and assessment tool categories

Question 26: Assessing the Infrastructure Layer

A company has separate assessments for its application code and public website. Its next approved task is a cloud infrastructure security assessment. The analyst must select a tool from the cloud infrastructure assessment category in the CS0-004 objectives, not a web scanner or network discovery tool. Which choice fits?

A) An approved Prowler assessment.

B) An approved Nikto assessment.

C) An approved Masscan assessment.

D) An approved Zed Attack Proxy assessment.

👁 Reveal Answer

Correct Answer: A

Explanation: A is explicitly listed among cloud infrastructure assessment tools in the current objectives. That classification matches the layer specified in the task. B is listed as a web application scanner, so it does not match this selection requirement. C belongs to network scanning and mapping. D also belongs to web application scanning. Selecting the correct category is only a starting point; the actual assessment still requires approved scope and suitable access to the environment.

Reference: CompTIA CySA+ CS0-004 exam objectives, 2.2: Cloud infrastructure assessment tools

Question 27: Choosing the First Remediation

Two confirmed vulnerabilities have the same CVSS base score and available patches. One affects an internet-facing payment service and has credible evidence of active exploitation. The other affects an isolated training server with no known exploitation. Only one can be patched in today’s window. Which prioritization best uses the available risk context?

A) Patch the training server because isolation increases exposure.

B) Patch either server because identical scores imply identical risk.

C) Patch the training server because no exploitation is reported.

D) Patch the payment service because exposure and impact raise urgency.

👁 Reveal Answer

Correct Answer: D

Explanation: D considers active exploitation, external exposure, and the payment service’s business importance. The equal base scores do not remove those differences. A reverses the stated isolation context rather than identifying a greater attack opportunity. B treats a severity score as a complete assessment of environmental risk. C gives priority to the absence of exploitation instead of the credible exploitation evidence. The training server still needs remediation, but the provided context supports addressing the payment service first.

Reference: CompTIA CySA+ CS0-004 exam objectives, 2.3: Active exploitation, asset value, impact, and context awareness

Question 28: Reducing Exposure Before a Patch

A legacy reporting service has a confirmed vulnerability in its management interface. The owner cannot install the available patch until a tested maintenance window next week. An approved network rule can restrict that interface to the dedicated administration subnet without interrupting reports. Which interim action best reduces the exposed attack surface?

A) Keep broad interface access and record the patch as completed.

B) Restrict interface access and retain the scheduled patch task.

C) Keep broad interface access and extend the scan interval.

D) Suppress the scanner finding and cancel the scheduled patch.

👁 Reveal Answer

Correct Answer: B

Explanation: B applies an approved compensating control that reduces access to the vulnerable interface while preserving the actual remediation plan. It does not claim that network restrictions remove the software flaw. A leaves the exposure unchanged and misrepresents patch status. C reduces assessment frequency rather than reducing access to the interface. D hides the finding and abandons remediation. The restriction should be validated, and the remaining risk should stay visible until the planned patch is applied and checked.

Reference: CompTIA CySA+ CS0-004 exam objectives, 2.3: Attack surface management and compensating controls

Question 29: Closing a Remediation Ticket

An administrator marks a patch deployment successful. The analyst must confirm that the specific vulnerability is remediated on the affected server before closing its ticket. The follow-up assessment is authorized, and the original finding depended on authenticated local checks. Which evidence most directly supports closure?

A) A deployment message showing that the patch job finished.

B) A discovery result showing that the server remains reachable.

C) A successful authenticated recheck showing the finding is resolved.

D) A new report that excludes the server from its assessment scope.

👁 Reveal Answer

Correct Answer: C

Explanation: C validates the specific remediation with the local visibility required by the original check. A successful authenticated recheck is stronger evidence than a deployment status alone. A shows that a job finished, not that the vulnerability is absent. B establishes reachability rather than patch effectiveness. D removes the asset from evaluation and supplies no remediation evidence. A missing finding only supports closure when the relevant check actually ran successfully against the correct affected asset.

Reference: CompTIA CySA+ CS0-004 exam objectives, 2.3: Validation of remediation

Question 30: Testing Before Runtime Exists

A developer submits first-party source code for a new service. No runnable test environment exists yet. The security team wants an automated check for potential weaknesses in that code without executing it, rather than a dependency inventory or a maturity review. Which assessment should it use?

A) Static application security testing of the submitted code.

B) Dynamic application security testing of the running service.

C) Software composition analysis of third-party dependencies.

D) A software assurance maturity review of the team process.

👁 Reveal Answer

Correct Answer: A

Explanation: A analyzes code without executing the program, matching both the available artifact and the stated constraint. Static findings identify potential weaknesses that still require review. B evaluates a running application, which the scenario does not yet provide. C addresses dependency and third-party component concerns rather than the requested first-party code analysis. D evaluates assurance practices rather than automatically analyzing this code submission. Static and dynamic testing complement each other; one does not make the other unnecessary later.

Reference: Microsoft Learn: Securing a development lifecycle, SAST and DAST definitions (maps to CS0-004 objective 2.4)

Study Tips for Vulnerability Assessment and Prioritization

• Establish scope first. Reconcile the asset inventory and authorization before planning assessment traffic.
• Match visibility to the task. Credentialed, passive, baseline, and application assessments answer different questions.
• Add environmental context. Combine severity with exploitation evidence, exposure, asset value, and business impact.
• Verify the outcome. A compensating control reduces risk, while a successful remediation check supplies evidence for closure.

Keep Practicing for CompTIA CySA+

Revisit CS0-004 Questions 11-20 for threat hunting and SOC reporting. Review these CS0-004 vulnerability assessment questions before the next set, which will cover incident response and evidence handling.