GPEN Vulnerability Scanning Practice Test 2 — 15 Questions

Question 1

During a vulnerability scan of a web application, the scanner reports a critical SQL injection vulnerability on a login form. A manual test using a single quote in the username field returns a generic error page with no database details. The scanner's evidence shows a time-based blind SQL injection payload that caused a five-second delay. Which action should the penetration tester take next to validate the finding?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Manually inject a time-based payload that includes a conditional delay, such as '; IF (1=1) WAITFOR DELAY '0:0:5'--, and compare response times with a false condition.. The most reliable way to confirm time-based blind SQL injection is to use a conditional payload that delays only when a true condition is met, and compare that with a false condition. This controls for network and server latency, demonstrating that the delay is caused by the injected SQL logic. Simply re-running the scanner or relying on a single delay is insufficient for validation.

Answer

Immediately report the SQL injection as a confirmed critical finding based on the scanner's time-based evidence.

Answer

Re-run the scanner with the same payload multiple times and compare the response times to confirm the delay is consistent.

Answer

Submit the login form with a benign username and password to check if the application returns a different error, then conclude the vulnerability is a false positive.

Question 2

A penetration tester is using Nessus to scan a large subnet and needs to avoid overwhelming older printers that are known to crash when too many simultaneous connections are made. The tester also wants to ensure the scan completes in a reasonable timeframe. Which Nessus scan policy setting should be adjusted to control the number of simultaneous hosts being scanned?

Accepted Answer

Max concurrent hosts. The Max concurrent hosts setting directly controls how many hosts are scanned at the same time. Lowering this value ensures that fewer devices are probed concurrently, reducing the chance of crashing sensitive equipment like older printers. It balances scan speed with safety, making it the appropriate adjustment for the scenario.

Answer

Reduce parallel checks per host

Answer

Scan window size

Answer

Max concurrent checks per host

Question 3

A penetration tester is configuring a vulnerability scanner to assess a sensitive production network. The tester wants to avoid causing service disruptions or overwhelming network devices. Which scanner setting should be adjusted to best achieve this?

Accepted Answer

Enable safe checks and reduce the scan's performance settings to limit simultaneous connections.. To avoid disrupting a sensitive production network, the scanner should be configured with safe checks enabled and performance settings lowered to reduce concurrent connections and packet rate. This minimizes the risk of overwhelming devices or causing service outages. Disabling DoS plugins and avoiding aggressive timing are also important, but safe checks and reduced performance are the primary controls.

Answer

Disable all plugin families except those that perform denial-of-service testing to quickly identify weak points.

Answer

Set the scanner to use a random port order and maximum timing template to evade detection.

Answer

Increase the maximum number of concurrent hosts and checks per host to finish faster.

Question 4

During a penetration test, a tester runs an OpenVAS scan against a web server and receives a report indicating a high-severity vulnerability with a CVE identifier. Before including it in the final report, the tester wants to verify if the vulnerability is actually exploitable. Which action should the tester take next?

Accepted Answer

Manually test the vulnerability using a proof-of-concept exploit or crafted request.. Manual testing with a proof-of-concept or crafted request is the most reliable way to verify that a reported vulnerability is exploitable. It provides concrete evidence, reduces false positives, and ensures the finding is accurate before reporting. Other actions may offer context but do not directly confirm exploitability.

Answer

Check the CVE details in the National Vulnerability Database (NVD).

Answer

Review the scanner's plugin documentation to understand the detection logic.

Answer

Re-run the scan with a different scanner to confirm the finding.

Question 5

A penetration tester is analyzing the results of a vulnerability scan and needs to prioritize remediation efforts. Which two factors should be considered when determining the criticality of a vulnerability? (Choose two.)

Accepted Answer

The potential impact on the business if exploited. CVSS base score and business impact are key factors for prioritizing vulnerabilities. CVSS provides a standardized severity metric, while business impact ensures that remediation efforts focus on what matters most to the organization. Together, they help balance technical severity with real-world consequences.

Answer

The age of the vulnerability in the CVE database

Answer

The number of other vulnerabilities on the same host

Answer

The scanner's confidence level in the finding

Question 6

A penetration tester is using Nmap to scan a target network and wants to identify open UDP ports. The tester runs a UDP scan but notices that many ports are reported as 'open|filtered'. Which technique can help determine whether these ports are actually open or filtered?

Accepted Answer

Send a UDP packet with a known payload and analyze the response.. Sending a UDP packet with a known payload that triggers a response from a specific service can help determine if a port is open. If the service responds, the port is open; if no response or an ICMP unreachable is received, it may be filtered. This active probing provides more definitive results than generic scans.

Answer

Use a TCP ACK scan to infer UDP port states.

Answer

Perform a TCP SYN scan on the same ports.

Answer

Run a UDP scan with a longer timeout and more retries.

Question 7

A penetration tester needs to scan a large enterprise network for vulnerabilities but has only a short maintenance window. The tester wants to maximize scan coverage while minimizing the impact on production systems. Which Nessus scan policy setting should the tester adjust to balance speed and accuracy?

Accepted Answer

Adjust the 'Performance' settings to use a 'Custom' scan with optimized timeouts and throttling.. The correct answer involves adjusting performance settings to a custom configuration. This allows the tester to optimize timeouts, throttling, and concurrency to complete the scan within the maintenance window while maintaining sufficient accuracy. Other options either focus solely on safety, risk disruption, or reduce coverage, failing to balance speed and accuracy as required.

Answer

Enable 'Safe checks' to prevent denial-of-service conditions.

Answer

Increase the 'Max concurrent checks per host' value.

Answer

Disable 'Thorough tests' to reduce scan time.

Question 8

A penetration tester is using Nmap to scan a target subnet and wants to identify all hosts that are up without performing port scanning. The tester also wants to avoid sending TCP SYN packets to reduce noise. Which Nmap option should the tester use?

Accepted Answer

-sn. The -sn option is designed for host discovery only, performing a ping scan without port scanning. It sends various probes to determine if hosts are up, but does not scan ports, thus reducing noise from TCP SYN packets to ports. Other options either perform port scanning, are deprecated, or skip discovery entirely, making them unsuitable for the scenario.

Answer

-sS

Answer

-sP

Answer

-Pn

Question 9

A penetration tester is conducting a vulnerability scan against a web application and notices that the scanner reports a critical SQL injection vulnerability on a page that does not accept user input. The tester manually verifies the page and finds no input fields or parameters. What is the most likely cause of this false positive?

Accepted Answer

The scanner is configured to perform blind SQL injection tests by injecting payloads into HTTP headers.. The most likely cause is that the scanner injects payloads into HTTP headers, which the application may log into a database. If the logging is vulnerable, the scanner could detect SQL injection even though the page itself has no input. This is a common source of false positives in web application scanning. Other options do not explain why a false positive would occur on a page with no user input.

Answer

The scanner is using an outdated vulnerability database.

Answer

The scanner is using a safe checks policy that skips destructive tests.

Answer

The scanner is unable to authenticate to the web application.

Question 10

A penetration tester is planning a vulnerability scan of a network that includes legacy systems and IoT devices. The tester needs to minimize the risk of disrupting these fragile devices while still gathering useful vulnerability data. Which two actions should the tester take? (Choose two.)

Accepted Answer

Configure the scanner to throttle network traffic and reduce the number of concurrent hosts scanned.. Enabling safe checks and throttling network traffic are the two actions that directly reduce the risk of disrupting legacy systems and IoT devices. Safe checks avoid potentially harmful tests, while throttling and reduced concurrency prevent overwhelming devices with too much traffic. The other options either increase load, broaden the scan unnecessarily, or do not address the specific fragility of these devices.

Answer

Increase the scan's maximum number of concurrent checks per host to speed up the scan.

Answer

Use a TCP SYN scan instead of a TCP connect scan to reduce the number of packets sent.

Answer

Disable host discovery and scan all IP addresses in the range.

Question 11

A penetration tester is configuring a vulnerability scan against a large enterprise network. The tester needs to balance scan accuracy, speed, and impact on production systems. Which TWO of the following settings, when adjusted, will MOST directly reduce the risk of disrupting fragile network devices during the scan? (Choose two.)

Accepted Answer

Enable 'Safe Checks' in the scan policy.. The two settings that most directly reduce disruption are Safe Checks and Max checks per host. Safe Checks excludes plugins known to potentially crash services, while lowering Max checks per host throttles concurrent probes to each target. Together they limit both the type and the rate of intrusive traffic, protecting fragile production devices. Other options either increase load or do not specifically target device stability.

Answer

Increase the maximum number of concurrent hosts scanned.

Answer

Disable 'Thorough tests' in the scan policy.

Answer

Set the scanner to use UDP instead of TCP for all checks.

Question 12

A penetration tester is reviewing the results of a vulnerability scan and sees a finding labeled 'SSL Certificate Expired' on a web server. The tester confirms that the certificate is indeed expired. What is the most appropriate next step according to typical penetration testing methodology?

Accepted Answer

Document the finding, verify its impact, and include it in the final report with remediation recommendations.. The appropriate next step is to document the finding, verify its impact, and include it in the report with remediation recommendations. Expired certificates are configuration issues that can affect security and compliance but are not typically exploitable. The tester should not attempt to exploit or fix the issue unless authorized. Ignoring it would be improper as it is a valid finding.

Answer

Attempt to renew the certificate yourself to fix the issue.

Answer

Immediately exploit the expired certificate to gain unauthorized access.

Answer

Ignore the finding because expired certificates are not security vulnerabilities.

Question 13

A penetration tester has completed an unauthenticated vulnerability scan of a web server and received a report listing several critical CVEs. Before including these in the final report, the tester wants to validate that the findings are not false positives. Which action is the MOST appropriate next step?

Accepted Answer

Manually verify the finding by checking the actual service version and testing the vulnerability.. Manual verification is the gold standard for confirming scanner findings. By directly checking the service version, inspecting configuration, or safely testing the vulnerability, the tester obtains evidence that the issue is real. This eliminates false positives and ensures the report is accurate. Other options either do not validate the specific finding or risk reporting unverified critical issues.

Answer

Lower the scan's severity threshold and rescan to see if more issues appear.

Answer

Re-run the scan with a different scanner and compare results.

Answer

Assume the scanner is correct and include the finding as critical.

Question 14

A penetration tester is using Nmap with the NSE script 'vulners' to identify vulnerabilities on a target. The scan returns a list of CVEs for detected services, but the tester notices that some CVEs have a low confidence score. What is the MOST accurate interpretation of these low-confidence findings?

Accepted Answer

They are potential matches based on version correlation and should be manually verified before reporting.. Low confidence in vulners output signals an approximate version-to-CVE match. Because service banners can be incomplete or versions backported, the script cannot be certain the vulnerability exists. The correct response is to treat these as potential findings and manually verify the service's exact version and patch state before reporting. This avoids both false positives and false negatives.

Answer

They indicate that the CVE is not in the NVD database and is therefore invalid.

Answer

They indicate that the vulnerability is likely a false positive and should be ignored.

Answer

They represent vulnerabilities that require authentication to exploit and are therefore lower risk.

Question 15

A penetration tester is preparing to scan a network that includes a mix of traditional IT systems and industrial control systems (ICS). The tester wants to minimize the risk of disrupting ICS devices. Which scanning approach is MOST appropriate for the ICS segment?

Accepted Answer

Use a passive scanner that only listens to network traffic without sending packets.. Passive scanning is the safest method for ICS because it does not send any traffic that could disrupt fragile devices. It relies on observing existing network traffic to identify assets and potential vulnerabilities. Active scanning, even with Safe Checks or during maintenance, carries inherent risk of causing outages. For OT environments, passive monitoring is the recommended first step before any active testing.

Answer

Perform an aggressive Nmap scan with OS detection and version scanning.

Answer

Scan the ICS segment during a planned maintenance window with Safe Checks enabled.

Answer

Run a credentialed scan with default settings to get the most accurate results.