Vulnerability Scanning GPEN Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When configuring a vulnerability scan, what is the purpose of setting a scan policy?

   • ATo encrypt the scan results before they are stored
   • BTo define the scope, intensity, and specific checks that the scanner will perform
   • CTo determine the IP address of the target system
   • DTo automatically remediate any vulnerabilities that are found during the scan
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A vulnerability scan report lists a 'High' severity finding for a service that is no longer in use and has been disabled on the target system. The tester confirms that the service is disabled and not reachable. How should the tester handle this finding in the final report?

   • ARemove the finding from the report because the service is disabled.
   • BChange the severity to 'Low' but keep it in the report without explanation.
   • CReport the finding as a false positive or informational, noting that the service is disabled and not reachable.
   • DReport it as a high-severity finding because the scanner detected it.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is a key limitation of vulnerability scanning that a penetration tester must consider when interpreting scan results?

   • AVulnerability scans can only be run against systems that are currently online and reachable
   • BVulnerability scans are unable to detect any vulnerabilities in web applications
   • CVulnerability scans require administrative credentials to be effective in all cases
   • DVulnerability scans produce a high number of false positives that require manual validation
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is a key characteristic of an effective vulnerability scan report?

   • AIt is tailored to the audience, with clear explanations of risk and actionable remediation steps
   • BIt lists every vulnerability with its technical name and CVE ID, but avoids any recommendations
   • CIt includes only the critical vulnerabilities to keep the report concise
   • DIt uses highly technical jargon to demonstrate the tester's expertise
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Why is it important to schedule vulnerability scans during maintenance windows or off-peak hours?

   • ATo reduce the impact on network and system performance, as scans can generate significant traffic and load
   • BTo ensure that the scan results are more accurate because fewer users are logged in
   • CTo prevent the scanner from being detected by intrusion detection systems
   • DTo comply with legal requirements that prohibit scanning during business hours
   Reveal Solution Discussion Select an answer first