Vulnerability Scanning GPEN Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A penetration tester is comparing vulnerability scanning tools for a client that requires both network and web application scanning. The client has a limited budget and prefers open-source tools. Which combination of tools is most appropriate?

   • AUse Nessus for both network and web application scanning.
   • BUse Burp Suite Community Edition for network scanning and OpenVAS for web application scanning.
   • CUse OpenVAS for network scanning and OWASP ZAP for web application scanning.
   • DUse Nmap for both network and web application scanning.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A client asks a penetration tester to explain why a vulnerability scan is not a substitute for a full penetration test. The client wants to understand the limitations of vulnerability scanning. Which statement best explains a key limitation?

   • AVulnerability scans cannot detect any vulnerabilities that are not already known to the scanner vendor.
   • BVulnerability scans are only useful for external networks and not for internal networks.
   • CVulnerability scans are always passive and cannot interact with the target systems.
   • DVulnerability scans do not require credentials and therefore cannot provide any useful information.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A penetration tester is asked to scan a network segment that contains legacy systems that are known to crash under aggressive scanning. The tester needs to identify vulnerabilities without causing downtime. Which scan configuration is most appropriate?

   • AUse a slow, low-intensity scan with a reduced port list and safe checks enabled.
   • BUse a full port scan with aggressive timing and all vulnerability checks enabled.
   • CUse an authenticated scan with full port range but disable safe checks to speed up the scan.
   • DUse a passive scan only, because active scanning is never safe for legacy systems.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A penetration tester is planning a vulnerability scan for a client's environment that includes both a production network and a development network. The client requires that the production scan be performed during a maintenance window to avoid impact, while the development network can be scanned anytime. The tester has limited time and must produce a consolidated report. Which approach best balances the constraints?

   • ARun only the production scan during the maintenance window and skip the development scan to save time.
   • BRun the development scan first and the production scan later without a maintenance window, because the client's constraint is not critical.
   • CRun the production scan during the maintenance window and the development scan immediately after, then merge the results into one report.
   • DRun both scans simultaneously during the maintenance window to save time.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is an open-source vulnerability scanner commonly used for network vulnerability assessment?

   • AOpenVAS
   • BBurp Suite
   • CQualys
   • DNessus
   Reveal Solution Discussion Select an answer first