When communicating scan findings to non-technical stakeholders, what is the most effective approach?

Only discuss the vulnerabilities that have a known exploit available

Present the raw scan output and let them interpret the technical details

Focus on the business impact and recommended actions, using non-technical language

Use technical terms such as CVE and CVSS without explanation to ensure accuracy

After running a vulnerability scan, the report lists a critical SQL injection in a web application. The tester manually verifies the finding and confirms it is a true positive. What should the tester do next?

Include the confirmed finding in the final report with evidence and remediation guidance.

Remove the finding from the report because it was manually confirmed.

Re-run the scan multiple times to ensure the result is consistent.

Immediately inform the system owner and provide the raw scan output.

After a vulnerability scan, a tester notices that a critical vulnerability is reported on a web server. What is the most appropriate next step before including it in the final report?

Change the severity rating to low to avoid alarming the client

Immediately report it as a confirmed critical vulnerability to the client

Manually verify the vulnerability to confirm it is not a false positive

Ignore the finding because automated scanners are always accurate

GIAC Penetration Tester (GPEN)

Domain 1Objective 4

Vulnerability Scanning GPEN Practice Questions (Page 2)

Part of the Penetration Testing Foundations domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

6concepts

Questions 6–10

6foundation · easy
When communicating scan findings to non-technical stakeholders, what is the most effective approach?
Select an answer first
7application · medium
After running a vulnerability scan, the report lists a critical SQL injection in a web application. The tester manually verifies the finding and confirms it is a true positive. What should the tester do next?
Select an answer first
8foundation · easy
Which scanning approach is characterized by observing network traffic without sending any packets to the target systems?
Select an answer first
9foundation · easy
A penetration tester needs to perform a vulnerability scan that includes both network and web application scanning in a single tool. Which tool is best suited for this requirement?
Select an answer first
10foundation · easy
After a vulnerability scan, a tester notices that a critical vulnerability is reported on a web server. What is the most appropriate next step before including it in the final report?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Vulnerability Scanning GPEN Practice Questions (Page 2)

Questions 6–10

When communicating scan findings to non-technical stakeholders, what is the most effective approach?

After running a vulnerability scan, the report lists a critical SQL injection in a web application. The tester manually verifies the finding and confirms it is a true positive. What should the tester do next?

Which scanning approach is characterized by observing network traffic without sending any packets to the target systems?

A penetration tester needs to perform a vulnerability scan that includes both network and web application scanning in a single tool. Which tool is best suited for this requirement?

After a vulnerability scan, a tester notices that a critical vulnerability is reported on a web server. What is the most appropriate next step before including it in the final report?

Keep studying — Penetration Testing Foundations