GPEN Vulnerability Scanning — 15 Questions

Question 1

Which THREE of the following are primary causes for high false-positive rates in automated vulnerability scanning?

Accepted Answer

Relying strictly on banner grabbing rather than file version checks.. False positives often stem from banner-based detection failing to account for patched backports, lack of authentication resulting in superficial checks, or non-standard service configurations. Understanding these causes is critical because excessive false positives lead to alert fatigue, causing security teams to ignore genuine threats. Addressing these issues requires refining scan policies to use authenticated access and verifying findings manually against actual system patch levels.

Answer

Failing to update the scanner's plugin database prior to running the scan.

Answer

Scanning the target from a different subnet than the target server.

Question 2

Which TWO of the following should be considered when selecting a vulnerability scanning window for a production environment?

Accepted Answer

The potential for the scanner to trigger denial-of-service conditions on legacy hardware.. Selecting a scanning window involves balancing the need for visibility with the risk of service disruption or performance degradation. Production environments are sensitive to load, so coordinating with stakeholders and monitoring system health are critical. If the scan causes a production outage, the vulnerability management process fails. Proper timing, such as during low-usage hours, minimizes business impact while ensuring that security teams receive actionable data to secure the organization.

Answer

The geographic location of the penetration testing team's main office.

Answer

The requirement to have all employees logged into the network at once.

Answer

The version of the operating system running on the scanner itself.

Question 3

During a scan, you notice that a specific host is consistently marked as 'down' despite being reachable via ping. What is the most likely cause?

Accepted Answer

The target host is configured to drop ICMP echo requests.. Host discovery mechanisms in scanners use multiple techniques, including ARP, ICMP, and TCP/UDP port probes. If a firewall or host-based security policy drops specific packet types, the scanner may conclude the host is offline. Identifying this issue is vital because if the scanner cannot perform host discovery, it will skip all vulnerability checks, leaving critical assets unassessed and effectively invisible to the security program.

Answer

The scanner is using the wrong network interface for the subnet.

Answer

The scanner's license limit for IP addresses has been exceeded.

Answer

The target host has an empty port list defined in the scan policy.

Question 4

Refer to the exhibit. The scan is taking significantly longer than expected. Which configuration change will most effectively increase the speed without causing network instability?

Accepted Answer

Increase the max_concurrent_hosts to 50.. The current `timeout_ms` of 500 is very aggressive, likely causing retransmissions, while `max_concurrent_hosts` is quite low for a large network. Increasing concurrency allows more work to happen in parallel, while adjusting the timeout prevents excessive retransmission cycles. Balancing these parameters is key to scan performance. If the scan is too slow, it becomes impractical for large environments, but if it is too aggressive, it risks crashing the network.

Answer

Decrease the timeout_ms to 100.

Answer

Decrease the threads_per_host to 1.

Answer

Change the depth to 'shallow'.

Question 5

Which THREE of the following are benefits of performing authenticated scans instead of unauthenticated scans?

Accepted Answer

Ability to check for local patches and configuration files.. Authenticated scans provide deeper visibility into the target by allowing the scanner to inspect local files, registry keys, and configuration settings that are inaccessible from the network. This eliminates the uncertainty of banner-based detection, leading to far fewer false positives and a much more accurate representation of the system's true security posture. This increased accuracy is vital for focused remediation efforts and reducing unnecessary maintenance tasks.

Answer

The ability to bypass all existing network firewalls.

Answer

Complete immunity from being detected by IDS systems.

Question 6

A vulnerability scanner is unable to authenticate to a Linux target despite providing correct SSH credentials. What is the most common reason for this failure in a hardened environment?

Accepted Answer

The target system has disabled password authentication for the SSH service.. Hardened Linux systems often disable password-based authentication for root or restrict SSH access to specific keys or source IPs. If the scanner uses a password instead of a key, or if the SSH configuration lacks necessary permissions for the service account, authentication will fail. This is a critical hurdle in automated scanning that requires careful configuration of service accounts and SSH policy alignment.

Answer

The scanner is using the wrong version of the SSH protocol.

Answer

The SSH service port has been changed from 22 to a random port.

Answer

The SSH service requires MFA for all login attempts.

Question 7

When scanning a segmented network, why is it recommended to place the scanner inside each segment rather than scanning through a firewall?

Accepted Answer

To avoid triggering the firewall's intrusion detection and prevention systems.. Scanning through a firewall often results in the firewall blocking or throttling the scanner's traffic, leading to incomplete results. Placing the scanner inside the segment provides a 'clean' view of the assets as they would be seen by an internal attacker who has already breached the perimeter. This provides a more accurate assessment of the true risk of internal lateral movement and local vulnerability exposure.

Answer

To increase the speed of the scan by avoiding network latency.

Answer

To reduce the amount of log data generated on the network switches.

Answer

To ensure that the scanner is visible to all users on the network.

Question 8

A penetration tester is performing an authenticated vulnerability scan against a Windows Server 2019 target using Tenable Nessus. The scan completes successfully but reports only a handful of informational findings, far fewer than expected given the server's outdated patch level. The tester verifies that the credentials are valid and that the Nessus service account has local administrator rights. Which configuration setting is the MOST likely cause of the limited results?

Accepted Answer

The scan policy has 'Enable credentialed checks' unchecked.. The scant results despite valid administrator credentials strongly indicate the scan never used those credentials for local checks. When credentialed checks are disabled in the policy, Nessus performs only unauthenticated enumeration, missing registry-based patch detection and local file versioning. Re-enabling credentialed checks allows the scanner to log in and compare installed updates against its plugin database, producing the expected volume of findings.

Answer

The scan policy is configured to 'Perform thorough tests (may disrupt your network)' disabled.

Answer

The scan policy has 'Safe Checks' enabled.

Answer

The scan policy has 'Only use credentials to perform local checks' disabled.

Question 9

A penetration tester is configuring an authenticated scan for a Windows environment. Which credential management strategy best minimizes the security impact while maintaining scan efficacy?

Accepted Answer

Create a dedicated service account with granular WMI and remote registry permissions.. Using dedicated, low-privilege service accounts with specific WMI and registry permissions minimizes the blast radius if credentials are intercepted. This approach adheres to the principle of least privilege, preventing the scanner from having full domain administrator access, which could be abused if the scanning server is compromised. Effective vulnerability management relies on deep system visibility without granting excessive authority to the scanning service.

Answer

Configure the scanner to use the Domain Administrator account for full registry access.

Answer

Use a local account with no password to allow quick automated authentication.

Answer

Store credentials in plain text in the scanner configuration file for easier automation.

Question 10

Refer to the exhibit. An Nmap scan returns output indicating a web server is responding, but the `http-enum` script fails to identify common directories. Which action should the tester take to improve detection?

Accepted Answer

Use a specialized web discovery tool like ffuf or Gobuster with a large wordlist.. The current command lacks service-specific depth. Adding a more comprehensive script category or using a specialized tool like Dirbuster or Burp Suite allows for brute-forcing against common file paths. Service version detection and enumeration scripts in Nmap are limited by the wordlist provided. Improving detection requires moving beyond passive enumeration into active path discovery, which is essential for identifying hidden administrative interfaces or unlinked configuration files.

Answer

Increase the timing template to -T5 to make the scan faster.

Answer

Add the --script-args='http-enum.basepath=/admin' argument to the command.

Answer

Change the scan to -sS to perform a stealthy SYN scan instead of service detection.

Question 11

What is the primary purpose of a 'delta' or 'differential' vulnerability scan?

Accepted Answer

To identify only the changes in the vulnerability posture since the last scan.. Delta scans focus on identifying changes in the environment since the last full assessment. By comparing current findings against a known baseline, testers can quickly isolate new vulnerabilities or unauthorized changes. This is vital for maintaining a continuous security posture, as it reduces scan times and allows security teams to prioritize remediation efforts on newly introduced risks without re-analyzing the entire stable environment.

Answer

To increase the intensity of the scan to ensure all ports are covered.

Answer

To bypass signature-based detection systems by using randomized payloads.

Answer

To perform an exhaustive search for zero-day vulnerabilities on all assets.

Question 12

Which phase of a vulnerability assessment typically involves comparing the output against a known database of CVEs?

Accepted Answer

Vulnerability Detection. After performing reconnaissance and data collection, the scanner matches discovered software versions and configurations against a vulnerability database. This matching phase is where the raw data is translated into actionable information. Understanding this is crucial because it highlights that the scanner's efficacy is strictly tied to the quality and recency of its signature database, which must be updated regularly to identify modern threats.

Answer

Host Discovery

Answer

Service Identification

Answer

Remediation Verification

Question 13

Which of the following actions is the most appropriate step after discovering a critical vulnerability that is currently being exploited in the wild?

Accepted Answer

Notify the system owners and trigger an out-of-band remediation process.. Immediate risk mitigation is required for vulnerabilities actively exploited in the wild. This involves prioritizing remediation and documenting the findings. Following standard vulnerability management practices ensures that the highest risks are addressed first, which is essential to minimize the window of exposure. Waiting for a formal report before taking action on actively exploited vulnerabilities could result in a successful compromise of the organization's infrastructure.

Answer

Wait until the full scan report is generated at the end of the month.

Answer

Re-run the scan to verify the vulnerability is not a false positive.

Answer

Isolate the server from the network immediately without notifying anyone.

Question 14

Which document should a penetration tester consult to determine the allowed scope and rules of engagement for a vulnerability scan?

Accepted Answer

The Rules of Engagement (RoE) document.. The Rules of Engagement (RoE) or Statement of Work (SOW) defines the legal and operational boundaries of the assessment. It specifies which systems are in scope, which are out of scope, and what scanning techniques are permitted. Adhering to these documents is essential for maintaining compliance and avoiding unauthorized actions that could lead to legal repercussions or unintended service disruption during the testing phase.

Answer

The organization's public-facing bug bounty program policy.

Answer

The vendor's hardware specification sheets.

Answer

The latest version of the Common Vulnerabilities and Exposures (CVE) list.

Question 15

A penetration tester is preparing to run a credentialed vulnerability scan against a mixed environment of Windows Server 2019 and Ubuntu 20.04 hosts on an internal /24 subnet. The tester wants to reduce scan duration and network load while still detecting missing patches and misconfigurations. Which two scanning techniques should the tester implement to achieve these goals? (Choose two.)

Accepted Answer

Use SSH and SMB credentials to allow the scanner to query the local patch database and installed software inventory.. Credentialed scanning with local security checks is the most efficient way to detect missing patches and misconfigurations while minimizing network traffic and scan time. Supplying administrative credentials for Windows and SSH credentials for Linux allows the scanner to read local patch databases and software inventories directly, avoiding extensive remote probing. This approach improves accuracy and reduces load compared to unauthenticated or overly aggressive scanning methods.

Answer

Configure the scanner to perform a SYN stealth scan on all 65,535 TCP ports for every host before authenticating.

Answer

Limit the scan to a predefined list of common ports and disable all plugin families except 'Denial of Service'.

Answer

Set the scanner to use a very aggressive timing template to maximize parallelism across all hosts.