Vulnerability Scanning GPEN Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A penetration tester is conducting a vulnerability assessment for a client that has a mix of cloud-hosted and on-premises systems. The client wants to identify vulnerabilities that are exploitable from the internet, but also wants to assess the internal network from the perspective of a compromised host. The tester has credentials for both environments. Which scanning strategy is most effective?

   • ARun a passive scan on the cloud-hosted systems and an active scan on the on-premises systems, both without credentials.
   • BRun only an external scan against all systems, including internal on-premises systems, because they are all reachable from the internet.
   • CRun an external scan against the cloud-hosted systems and an internal scan from within the on-premises network, using credentials where available.
   • DRun only an internal scan from the on-premises network, because it can also assess the cloud-hosted systems.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A penetration tester is planning to scan a client's network that includes both internal servers and external-facing systems. The client wants to minimize the risk of the scan affecting production systems. The tester needs to identify vulnerabilities that are visible from the internet and also those that are only visible from inside the network. Which scanning approach is most appropriate?

   • ARun only an internal scan with credentials, because internal scans can also identify external-facing issues.
   • BRun separate external and internal scans, each with appropriate target ranges and credentials.
   • CRun a passive scan on the internal network and an active scan on the external network, both without credentials.
   • DRun a single external scan that covers all IP ranges, including internal addresses.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary difference between authenticated and unauthenticated vulnerability scanning?

   • AAuthenticated scanning is performed from inside the network, while unauthenticated scanning is performed from outside the network
   • BAuthenticated scanning is only possible on Windows systems, while unauthenticated scanning works on all operating systems
   • CAuthenticated scanning is slower but more accurate, while unauthenticated scanning is faster but less accurate
   • DAuthenticated scanning requires valid credentials and provides deeper visibility into system configuration, while unauthenticated scanning relies on external observations
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A penetration tester needs to perform a quick vulnerability assessment of a small network with limited time. The tester wants to identify open ports and known vulnerabilities in services running on those ports. Which tool combination is most efficient for this task?

   • AUse only Nmap with the default NSE scripts to identify all vulnerabilities.
   • BUse a web application scanner like Burp Suite to scan all network services.
   • CUse only a vulnerability scanner with a full port scan and all checks enabled.
   • DUse Nmap to discover open ports and then run a vulnerability scanner like OpenVAS against the discovered services.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A penetration tester has completed a vulnerability scan of a client's network and identified several critical vulnerabilities. The client's management team is non-technical and needs to understand the business risk and the urgency of remediation. Which approach is best for communicating the findings?

   • APresent only the vulnerabilities that have a CVSS score of 9.0 or higher, and omit the rest.
   • BCreate an executive summary that highlights the most critical risks in business terms and recommends a remediation timeline.
   • CSend a list of all vulnerabilities with their CVE IDs and let the IT team explain them to management.
   • DProvide a raw scan report with all technical details and CVSS scores.
   Reveal Solution Discussion Select an answer first