GPEN Vulnerability Scanning — 20 Questions

Question 1

Which THREE of the following are primary causes for high false-positive rates in automated vulnerability scanning?

Accepted Answer

Relying strictly on banner grabbing rather than file version checks.. False positives often stem from banner-based detection failing to account for patched backports, lack of authentication resulting in superficial checks, or non-standard service configurations. Understanding these causes is critical because excessive false positives lead to alert fatigue, causing security teams to ignore genuine threats. Addressing these issues requires refining scan policies to use authenticated access and verifying findings manually against actual system patch levels.

Answer

Failing to update the scanner's plugin database prior to running the scan.

Answer

Scanning the target from a different subnet than the target server.

Question 2

Which TWO of the following should be considered when selecting a vulnerability scanning window for a production environment?

Accepted Answer

The potential for the scanner to trigger denial-of-service conditions on legacy hardware.. Selecting a scanning window involves balancing the need for visibility with the risk of service disruption or performance degradation. Production environments are sensitive to load, so coordinating with stakeholders and monitoring system health are critical. If the scan causes a production outage, the vulnerability management process fails. Proper timing, such as during low-usage hours, minimizes business impact while ensuring that security teams receive actionable data to secure the organization.

Answer

The geographic location of the penetration testing team's main office.

Answer

The requirement to have all employees logged into the network at once.

Answer

The version of the operating system running on the scanner itself.

Question 3

During a scan, you notice that a specific host is consistently marked as 'down' despite being reachable via ping. What is the most likely cause?

Accepted Answer

The target host is configured to drop ICMP echo requests.. Host discovery mechanisms in scanners use multiple techniques, including ARP, ICMP, and TCP/UDP port probes. If a firewall or host-based security policy drops specific packet types, the scanner may conclude the host is offline. Identifying this issue is vital because if the scanner cannot perform host discovery, it will skip all vulnerability checks, leaving critical assets unassessed and effectively invisible to the security program.

Answer

The scanner is using the wrong network interface for the subnet.

Answer

The scanner's license limit for IP addresses has been exceeded.

Answer

The target host has an empty port list defined in the scan policy.

Question 4

Refer to the exhibit. The scan is taking significantly longer than expected. Which configuration change will most effectively increase the speed without causing network instability?

Accepted Answer

Increase the max_concurrent_hosts to 50.. The current `timeout_ms` of 500 is very aggressive, likely causing retransmissions, while `max_concurrent_hosts` is quite low for a large network. Increasing concurrency allows more work to happen in parallel, while adjusting the timeout prevents excessive retransmission cycles. Balancing these parameters is key to scan performance. If the scan is too slow, it becomes impractical for large environments, but if it is too aggressive, it risks crashing the network.

Answer

Decrease the timeout_ms to 100.

Answer

Decrease the threads_per_host to 1.

Answer

Change the depth to 'shallow'.

Question 5

Which THREE of the following are benefits of performing authenticated scans instead of unauthenticated scans?

Accepted Answer

Ability to check for local patches and configuration files.. Authenticated scans provide deeper visibility into the target by allowing the scanner to inspect local files, registry keys, and configuration settings that are inaccessible from the network. This eliminates the uncertainty of banner-based detection, leading to far fewer false positives and a much more accurate representation of the system's true security posture. This increased accuracy is vital for focused remediation efforts and reducing unnecessary maintenance tasks.

Answer

The ability to bypass all existing network firewalls.

Answer

Complete immunity from being detected by IDS systems.

Question 6

A vulnerability scanner is unable to authenticate to a Linux target despite providing correct SSH credentials. What is the most common reason for this failure in a hardened environment?

Accepted Answer

The target system has disabled password authentication for the SSH service.. Hardened Linux systems often disable password-based authentication for root or restrict SSH access to specific keys or source IPs. If the scanner uses a password instead of a key, or if the SSH configuration lacks necessary permissions for the service account, authentication will fail. This is a critical hurdle in automated scanning that requires careful configuration of service accounts and SSH policy alignment.

Answer

The scanner is using the wrong version of the SSH protocol.

Answer

The SSH service port has been changed from 22 to a random port.

Answer

The SSH service requires MFA for all login attempts.

Question 7

When scanning a segmented network, why is it recommended to place the scanner inside each segment rather than scanning through a firewall?

Accepted Answer

To avoid triggering the firewall's intrusion detection and prevention systems.. Scanning through a firewall often results in the firewall blocking or throttling the scanner's traffic, leading to incomplete results. Placing the scanner inside the segment provides a 'clean' view of the assets as they would be seen by an internal attacker who has already breached the perimeter. This provides a more accurate assessment of the true risk of internal lateral movement and local vulnerability exposure.

Answer

To increase the speed of the scan by avoiding network latency.

Answer

To reduce the amount of log data generated on the network switches.

Answer

To ensure that the scanner is visible to all users on the network.

Question 8

A penetration tester is performing an authenticated vulnerability scan against a Windows Server 2019 target using Tenable Nessus. The scan completes successfully but reports only a handful of informational findings, far fewer than expected given the server's outdated patch level. The tester verifies that the credentials are valid and that the Nessus service account has local administrator rights. Which configuration setting is the MOST likely cause of the limited results?

Accepted Answer

The scan policy has 'Enable credentialed checks' unchecked.. The scant results despite valid administrator credentials strongly indicate the scan never used those credentials for local checks. When credentialed checks are disabled in the policy, Nessus performs only unauthenticated enumeration, missing registry-based patch detection and local file versioning. Re-enabling credentialed checks allows the scanner to log in and compare installed updates against its plugin database, producing the expected volume of findings.

Answer

The scan policy is configured to 'Perform thorough tests (may disrupt your network)' disabled.

Answer

The scan policy has 'Safe Checks' enabled.

Answer

The scan policy has 'Only use credentials to perform local checks' disabled.

Question 9

A penetration tester is configuring an authenticated scan for a Windows environment. Which credential management strategy best minimizes the security impact while maintaining scan efficacy?

Accepted Answer

Create a dedicated service account with granular WMI and remote registry permissions.. Using dedicated, low-privilege service accounts with specific WMI and registry permissions minimizes the blast radius if credentials are intercepted. This approach adheres to the principle of least privilege, preventing the scanner from having full domain administrator access, which could be abused if the scanning server is compromised. Effective vulnerability management relies on deep system visibility without granting excessive authority to the scanning service.

Answer

Configure the scanner to use the Domain Administrator account for full registry access.

Answer

Use a local account with no password to allow quick automated authentication.

Answer

Store credentials in plain text in the scanner configuration file for easier automation.

Question 10

Refer to the exhibit. An Nmap scan returns output indicating a web server is responding, but the `http-enum` script fails to identify common directories. Which action should the tester take to improve detection?

Accepted Answer

Use a specialized web discovery tool like ffuf or Gobuster with a large wordlist.. The current command lacks service-specific depth. Adding a more comprehensive script category or using a specialized tool like Dirbuster or Burp Suite allows for brute-forcing against common file paths. Service version detection and enumeration scripts in Nmap are limited by the wordlist provided. Improving detection requires moving beyond passive enumeration into active path discovery, which is essential for identifying hidden administrative interfaces or unlinked configuration files.

Answer

Increase the timing template to -T5 to make the scan faster.

Answer

Add the --script-args='http-enum.basepath=/admin' argument to the command.

Answer

Change the scan to -sS to perform a stealthy SYN scan instead of service detection.

Question 11

What is the primary purpose of a 'delta' or 'differential' vulnerability scan?

Accepted Answer

To identify only the changes in the vulnerability posture since the last scan.. Delta scans focus on identifying changes in the environment since the last full assessment. By comparing current findings against a known baseline, testers can quickly isolate new vulnerabilities or unauthorized changes. This is vital for maintaining a continuous security posture, as it reduces scan times and allows security teams to prioritize remediation efforts on newly introduced risks without re-analyzing the entire stable environment.

Answer

To increase the intensity of the scan to ensure all ports are covered.

Answer

To bypass signature-based detection systems by using randomized payloads.

Answer

To perform an exhaustive search for zero-day vulnerabilities on all assets.

Question 12

Which phase of a vulnerability assessment typically involves comparing the output against a known database of CVEs?

Accepted Answer

Vulnerability Detection. After performing reconnaissance and data collection, the scanner matches discovered software versions and configurations against a vulnerability database. This matching phase is where the raw data is translated into actionable information. Understanding this is crucial because it highlights that the scanner's efficacy is strictly tied to the quality and recency of its signature database, which must be updated regularly to identify modern threats.

Answer

Host Discovery

Answer

Service Identification

Answer

Remediation Verification

Question 13

Which of the following actions is the most appropriate step after discovering a critical vulnerability that is currently being exploited in the wild?

Accepted Answer

Notify the system owners and trigger an out-of-band remediation process.. Immediate risk mitigation is required for vulnerabilities actively exploited in the wild. This involves prioritizing remediation and documenting the findings. Following standard vulnerability management practices ensures that the highest risks are addressed first, which is essential to minimize the window of exposure. Waiting for a formal report before taking action on actively exploited vulnerabilities could result in a successful compromise of the organization's infrastructure.

Answer

Wait until the full scan report is generated at the end of the month.

Answer

Re-run the scan to verify the vulnerability is not a false positive.

Answer

Isolate the server from the network immediately without notifying anyone.

Question 14

Which document should a penetration tester consult to determine the allowed scope and rules of engagement for a vulnerability scan?

Accepted Answer

The Rules of Engagement (RoE) document.. The Rules of Engagement (RoE) or Statement of Work (SOW) defines the legal and operational boundaries of the assessment. It specifies which systems are in scope, which are out of scope, and what scanning techniques are permitted. Adhering to these documents is essential for maintaining compliance and avoiding unauthorized actions that could lead to legal repercussions or unintended service disruption during the testing phase.

Answer

The organization's public-facing bug bounty program policy.

Answer

The vendor's hardware specification sheets.

Answer

The latest version of the Common Vulnerabilities and Exposures (CVE) list.

Question 15

A penetration tester is preparing to run a credentialed vulnerability scan against a mixed environment of Windows Server 2019 and Ubuntu 20.04 hosts on an internal /24 subnet. The tester wants to reduce scan duration and network load while still detecting missing patches and misconfigurations. Which two scanning techniques should the tester implement to achieve these goals? (Choose two.)

Accepted Answer

Use SSH and SMB credentials to allow the scanner to query the local patch database and installed software inventory.. Credentialed scanning with local security checks is the most efficient way to detect missing patches and misconfigurations while minimizing network traffic and scan time. Supplying administrative credentials for Windows and SSH credentials for Linux allows the scanner to read local patch databases and software inventories directly, avoiding extensive remote probing. This approach improves accuracy and reduces load compared to unauthenticated or overly aggressive scanning methods.

Answer

Configure the scanner to perform a SYN stealth scan on all 65,535 TCP ports for every host before authenticating.

Answer

Limit the scan to a predefined list of common ports and disable all plugin families except 'Denial of Service'.

Answer

Set the scanner to use a very aggressive timing template to maximize parallelism across all hosts.

Question 16

During a vulnerability scan of a web application, the scanner reports a critical SQL injection vulnerability on a login form. A manual test using a single quote in the username field returns a generic error page with no database details. The scanner's evidence shows a time-based blind SQL injection payload that caused a five-second delay. Which action should the penetration tester take next to validate the finding?

Accepted Answer

Manually inject a time-based payload that includes a conditional delay, such as '; IF (1=1) WAITFOR DELAY '0:0:5'--, and compare response times with a false condition.. The most reliable way to confirm time-based blind SQL injection is to use a conditional payload that delays only when a true condition is met, and compare that with a false condition. This controls for network and server latency, demonstrating that the delay is caused by the injected SQL logic. Simply re-running the scanner or relying on a single delay is insufficient for validation.

Answer

Immediately report the SQL injection as a confirmed critical finding based on the scanner's time-based evidence.

Answer

Re-run the scanner with the same payload multiple times and compare the response times to confirm the delay is consistent.

Answer

Submit the login form with a benign username and password to check if the application returns a different error, then conclude the vulnerability is a false positive.

Question 17

A penetration tester is using Nessus to scan a large subnet and needs to avoid overwhelming older printers that are known to crash when too many simultaneous connections are made. The tester also wants to ensure the scan completes in a reasonable timeframe. Which Nessus scan policy setting should be adjusted to control the number of simultaneous hosts being scanned?

Accepted Answer

Max concurrent hosts. The Max concurrent hosts setting directly controls how many hosts are scanned at the same time. Lowering this value ensures that fewer devices are probed concurrently, reducing the chance of crashing sensitive equipment like older printers. It balances scan speed with safety, making it the appropriate adjustment for the scenario.

Answer

Reduce parallel checks per host

Answer

Scan window size

Answer

Max concurrent checks per host

Question 18

A penetration tester is configuring a vulnerability scanner to assess a sensitive production network. The tester wants to avoid causing service disruptions or overwhelming network devices. Which scanner setting should be adjusted to best achieve this?

Accepted Answer

Enable safe checks and reduce the scan's performance settings to limit simultaneous connections.. To avoid disrupting a sensitive production network, the scanner should be configured with safe checks enabled and performance settings lowered to reduce concurrent connections and packet rate. This minimizes the risk of overwhelming devices or causing service outages. Disabling DoS plugins and avoiding aggressive timing are also important, but safe checks and reduced performance are the primary controls.

Answer

Disable all plugin families except those that perform denial-of-service testing to quickly identify weak points.

Answer

Set the scanner to use a random port order and maximum timing template to evade detection.

Answer

Increase the maximum number of concurrent hosts and checks per host to finish faster.

Question 19

During a penetration test, a tester runs an OpenVAS scan against a web server and receives a report indicating a high-severity vulnerability with a CVE identifier. Before including it in the final report, the tester wants to verify if the vulnerability is actually exploitable. Which action should the tester take next?

Accepted Answer

Manually test the vulnerability using a proof-of-concept exploit or crafted request.. Manual testing with a proof-of-concept or crafted request is the most reliable way to verify that a reported vulnerability is exploitable. It provides concrete evidence, reduces false positives, and ensures the finding is accurate before reporting. Other actions may offer context but do not directly confirm exploitability.

Answer

Check the CVE details in the National Vulnerability Database (NVD).

Answer

Review the scanner's plugin documentation to understand the detection logic.

Answer

Re-run the scan with a different scanner to confirm the finding.

Question 20

A penetration tester is analyzing the results of a vulnerability scan and needs to prioritize remediation efforts. Which two factors should be considered when determining the criticality of a vulnerability? (Choose two.)

Accepted Answer

The potential impact on the business if exploited. CVSS base score and business impact are key factors for prioritizing vulnerabilities. CVSS provides a standardized severity metric, while business impact ensures that remediation efforts focus on what matters most to the organization. Together, they help balance technical severity with real-world consequences.

Answer

The age of the vulnerability in the CVE database

Answer

The number of other vulnerabilities on the same host

Answer

The scanner's confidence level in the finding