GSEC Vulnerability Scanning and Penetration Testing — 10 Questions

Question 1

A security analyst is preparing to scan a production network segment containing legacy medical devices that cannot be patched or rebooted. The analyst wants to identify exposed services without causing device crashes or service interruptions. Which Nmap scan technique should the analyst use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

TCP SYN scan with -sS and -T2. The correct approach is a TCP SYN scan using -sS combined with -T2 polite timing. This half-open scan avoids completing the TCP handshake, which lowers the risk of crashing or hanging fragile devices. The polite timing template reduces packet rate and burstiness, further protecting legacy medical equipment. Together, these options allow the analyst to identify exposed services while minimizing disruption to production devices.

Answer

TCP ACK scan with -sA and -T1

Answer

TCP connect scan with -sT and -T0

Answer

TCP SYN scan with -sS and default timing

Question 2

A penetration tester is conducting an authorized assessment of a web application. The tester wants to identify vulnerabilities in the application's authentication and session management without causing denial of service or modifying data. Which tool and mode should the tester use to perform a safe, non-destructive scan?

Accepted Answer

Burp Suite Professional with passive scanning and manual testing using safe payloads. The correct method is to use Burp Suite Professional with passive scanning and manual testing using safe payloads. Passive scanning observes requests and responses without altering application state, while manual testing lets the tester carefully probe authentication and session management with payloads that do not modify data or cause denial of service. This balanced approach meets the objective of finding vulnerabilities while respecting the non-destructive constraints.

Answer

OWASP ZAP in safe mode with passive scanning only

Answer

OWASP ZAP in protected mode with active scanning enabled

Answer

Burp Suite Professional with active scanning and default settings

Question 3

A penetration tester is conducting an internal assessment and wants to discover live hosts on a subnet without performing port scanning. The tester has administrative privileges on the attacking machine. Which Nmap command should the tester use to perform a ping sweep only?

Accepted Answer

nmap -sn 192.168.1.0/24. The -sn flag is the correct modern Nmap option for a ping sweep, as it performs host discovery without port scanning. Other flags either skip discovery, list targets without probing, or use deprecated syntax.

Answer

nmap -sL 192.168.1.0/24

Answer

nmap -sP 192.168.1.0/24

Answer

nmap -Pn 192.168.1.0/24

Question 4

A security analyst is reviewing a vulnerability scan report and notices a finding for CVE-2021-44228 (Log4Shell) on a server. The analyst needs to confirm whether the vulnerability is actually exploitable. Which Metasploit module should the analyst use to safely verify the presence of the Log4Shell vulnerability without executing a full remote code payload?

Accepted Answer

auxiliary/scanner/http/log4shell_scanner. The auxiliary/scanner/http/log4shell_scanner is the correct choice because it performs a non-destructive check for Log4Shell by testing for JNDI callbacks. Exploit modules would attempt payload delivery, which is unnecessary and riskier for simple verification.

Answer

exploit/multi/http/log4shell_header_injection

Answer

auxiliary/scanner/http/log4j_scanner

Answer

exploit/multi/http/log4shell_http_headers

Question 5

A penetration tester is using OpenVAS (Greenbone Vulnerability Management) to scan a client network. The tester wants to ensure the scan does not disrupt fragile legacy systems that may crash under heavy load. Which OpenVAS scan configuration setting should the tester adjust to limit the number of concurrent hosts and checks?

Accepted Answer

Maximum concurrently executed NVTs per host. The correct setting is the maximum concurrently executed NVTs per host, as it directly limits how many vulnerability tests run in parallel on a single target. This reduces the chance of overwhelming legacy systems. Other settings control different aspects and do not provide the needed granularity.

Answer

Maximum concurrently scanned hosts

Answer

Scan speed

Answer

Network timeout

Question 6

A security analyst is preparing to run an authenticated vulnerability scan against a Windows Server 2019 host. The analyst has domain credentials with local administrator rights on the target. Which Nmap scan type should the analyst use to perform a full TCP connect scan without requiring raw packet privileges?

Accepted Answer

nmap -sT. The TCP connect scan (-sT) is the correct choice because it relies on the operating system's networking stack and does not need raw socket access, making it usable by unprivileged users. Other scan types such as SYN, UDP, or ACK scanning require raw packet privileges and serve different purposes.

Answer

nmap -sU

Answer

nmap -sA

Answer

nmap -sS

Question 7

A junior security analyst at a healthcare company must scan a subnet of 254 hosts for known vulnerabilities. The analyst has no budget for commercial tools and needs a scanner that is open source, actively maintained, and capable of authenticated and unauthenticated checks. Which tool BEST meets these requirements?

Accepted Answer

OpenVAS (Greenbone Vulnerability Management). OpenVAS, maintained as Greenbone Vulnerability Management, is the only option that is open source, actively updated, and free of per-host licensing limits. It supports both authenticated and unauthenticated scanning across large subnets, which matches the analyst's constraints. The other tools are either license-limited, not true vulnerability scanners, or designed for traffic analysis rather than vulnerability assessment.

Answer

Nessus Essentials

Answer

Nmap with the NSE vuln category

Answer

Wireshark

Question 8

During an authorized penetration test, a tester obtains a low-privilege shell on a Windows server and wants to identify missing patches and insecure configurations that a remote unauthenticated scan may have missed. Which action BEST supports this goal?

Accepted Answer

Upload and execute a local enumeration script such as WinPEAS or Seatbelt. After gaining a foothold, a penetration tester should perform local enumeration to find patch gaps and misconfigurations that remote scanning cannot see. WinPEAS and Seatbelt are purpose-built for this, collecting system, patch, and configuration data directly from the host. The other options either require additional credentials, focus on network discovery, or capture traffic without addressing local vulnerability state.

Answer

Perform a TCP SYN scan of the internal subnet from the compromised host

Answer

Run a credentialed vulnerability scan from the scanner appliance using domain admin credentials

Answer

Capture traffic with tcpdump on the compromised host for several hours

Question 9

A security consultant is configuring a Tenable Nessus scan to assess a mixed environment of Windows and Linux servers. The consultant needs to ensure the scan can authenticate to targets and perform local checks without relying on agent installation. Which two Nessus scan settings should the consultant configure to provide credentials for authenticated scanning? (Choose two.)

Accepted Answer

SSH credentials for Linux hosts. Authenticated scanning in Nessus for a mixed environment requires SSH credentials for Linux hosts and SMB credentials for Windows hosts. These allow the scanner to log in and perform local checks, increasing accuracy. Other credential types are for network devices or databases and do not fulfill the requirement.

Answer

Kerberos ticket for domain authentication

Answer

Database credentials for SQL Server instances

Answer

SNMP community strings for network devices

Question 10

A security team is configuring an authenticated vulnerability scan of a Linux server farm using SSH. The scanner reports that it cannot log in to several hosts even though the same credentials work manually. Which configuration change is MOST likely to resolve the issue?

Accepted Answer

Allow the scanner's public key in the authorized_keys file for the scan account. Authenticated SSH scans rely on the scanner presenting a key that the target accepts. When manual logins work but the scanner fails, the usual cause is that the scanner's public key has not been installed in the scan account's authorized_keys file. Adding that key restores authentication without weakening the host's security posture, unlike enabling password authentication or disabling SELinux.

Answer

Enable password authentication on the target hosts

Answer

Change the SSH port on the targets to 2222

Answer

Disable SELinux on the target hosts