GSEC Vulnerability Scanning and Penetration Testing — All Questions With Answers

Question 1

A security analyst is preparing to scan a production network segment containing legacy medical devices that cannot be patched or rebooted. The analyst wants to identify exposed services without causing device crashes or service interruptions. Which Nmap scan technique should the analyst use?

Accepted Answer

TCP SYN scan with -sS and -T2. The correct approach is a TCP SYN scan using -sS combined with -T2 polite timing. This half-open scan avoids completing the TCP handshake, which lowers the risk of crashing or hanging fragile devices. The polite timing template reduces packet rate and burstiness, further protecting legacy medical equipment. Together, these options allow the analyst to identify exposed services while minimizing disruption to production devices.

Answer

TCP ACK scan with -sA and -T1

Answer

TCP connect scan with -sT and -T0

Answer

TCP SYN scan with -sS and default timing

Question 2

A penetration tester is conducting an authorized assessment of a web application. The tester wants to identify vulnerabilities in the application's authentication and session management without causing denial of service or modifying data. Which tool and mode should the tester use to perform a safe, non-destructive scan?

Accepted Answer

Burp Suite Professional with passive scanning and manual testing using safe payloads. The correct method is to use Burp Suite Professional with passive scanning and manual testing using safe payloads. Passive scanning observes requests and responses without altering application state, while manual testing lets the tester carefully probe authentication and session management with payloads that do not modify data or cause denial of service. This balanced approach meets the objective of finding vulnerabilities while respecting the non-destructive constraints.

Answer

OWASP ZAP in safe mode with passive scanning only

Answer

OWASP ZAP in protected mode with active scanning enabled

Answer

Burp Suite Professional with active scanning and default settings

Question 3

A penetration tester is conducting an internal assessment and wants to discover live hosts on a subnet without performing port scanning. The tester has administrative privileges on the attacking machine. Which Nmap command should the tester use to perform a ping sweep only?

Accepted Answer

nmap -sn 192.168.1.0/24. The -sn flag is the correct modern Nmap option for a ping sweep, as it performs host discovery without port scanning. Other flags either skip discovery, list targets without probing, or use deprecated syntax.

Answer

nmap -sL 192.168.1.0/24

Answer

nmap -sP 192.168.1.0/24

Answer

nmap -Pn 192.168.1.0/24

Question 4

A security analyst is reviewing a vulnerability scan report and notices a finding for CVE-2021-44228 (Log4Shell) on a server. The analyst needs to confirm whether the vulnerability is actually exploitable. Which Metasploit module should the analyst use to safely verify the presence of the Log4Shell vulnerability without executing a full remote code payload?

Accepted Answer

auxiliary/scanner/http/log4shell_scanner. The auxiliary/scanner/http/log4shell_scanner is the correct choice because it performs a non-destructive check for Log4Shell by testing for JNDI callbacks. Exploit modules would attempt payload delivery, which is unnecessary and riskier for simple verification.

Answer

exploit/multi/http/log4shell_header_injection

Answer

auxiliary/scanner/http/log4j_scanner

Answer

exploit/multi/http/log4shell_http_headers

Question 5

A penetration tester is using OpenVAS (Greenbone Vulnerability Management) to scan a client network. The tester wants to ensure the scan does not disrupt fragile legacy systems that may crash under heavy load. Which OpenVAS scan configuration setting should the tester adjust to limit the number of concurrent hosts and checks?

Accepted Answer

Maximum concurrently executed NVTs per host. The correct setting is the maximum concurrently executed NVTs per host, as it directly limits how many vulnerability tests run in parallel on a single target. This reduces the chance of overwhelming legacy systems. Other settings control different aspects and do not provide the needed granularity.

Answer

Maximum concurrently scanned hosts

Answer

Scan speed

Answer

Network timeout

Question 6

A security analyst is preparing to run an authenticated vulnerability scan against a Windows Server 2019 host. The analyst has domain credentials with local administrator rights on the target. Which Nmap scan type should the analyst use to perform a full TCP connect scan without requiring raw packet privileges?

Accepted Answer

nmap -sT. The TCP connect scan (-sT) is the correct choice because it relies on the operating system's networking stack and does not need raw socket access, making it usable by unprivileged users. Other scan types such as SYN, UDP, or ACK scanning require raw packet privileges and serve different purposes.

Answer

nmap -sU

Answer

nmap -sA

Answer

nmap -sS

Question 7

A junior security analyst at a healthcare company must scan a subnet of 254 hosts for known vulnerabilities. The analyst has no budget for commercial tools and needs a scanner that is open source, actively maintained, and capable of authenticated and unauthenticated checks. Which tool BEST meets these requirements?

Accepted Answer

OpenVAS (Greenbone Vulnerability Management). OpenVAS, maintained as Greenbone Vulnerability Management, is the only option that is open source, actively updated, and free of per-host licensing limits. It supports both authenticated and unauthenticated scanning across large subnets, which matches the analyst's constraints. The other tools are either license-limited, not true vulnerability scanners, or designed for traffic analysis rather than vulnerability assessment.

Answer

Nessus Essentials

Answer

Nmap with the NSE vuln category

Answer

Wireshark

Question 8

During an authorized penetration test, a tester obtains a low-privilege shell on a Windows server and wants to identify missing patches and insecure configurations that a remote unauthenticated scan may have missed. Which action BEST supports this goal?

Accepted Answer

Upload and execute a local enumeration script such as WinPEAS or Seatbelt. After gaining a foothold, a penetration tester should perform local enumeration to find patch gaps and misconfigurations that remote scanning cannot see. WinPEAS and Seatbelt are purpose-built for this, collecting system, patch, and configuration data directly from the host. The other options either require additional credentials, focus on network discovery, or capture traffic without addressing local vulnerability state.

Answer

Perform a TCP SYN scan of the internal subnet from the compromised host

Answer

Run a credentialed vulnerability scan from the scanner appliance using domain admin credentials

Answer

Capture traffic with tcpdump on the compromised host for several hours

Question 9

A security consultant is configuring a Tenable Nessus scan to assess a mixed environment of Windows and Linux servers. The consultant needs to ensure the scan can authenticate to targets and perform local checks without relying on agent installation. Which two Nessus scan settings should the consultant configure to provide credentials for authenticated scanning? (Choose two.)

Accepted Answer

SSH credentials for Linux hosts. Authenticated scanning in Nessus for a mixed environment requires SSH credentials for Linux hosts and SMB credentials for Windows hosts. These allow the scanner to log in and perform local checks, increasing accuracy. Other credential types are for network devices or databases and do not fulfill the requirement.

Answer

Kerberos ticket for domain authentication

Answer

Database credentials for SQL Server instances

Answer

SNMP community strings for network devices

Question 10

A security team is configuring an authenticated vulnerability scan of a Linux server farm using SSH. The scanner reports that it cannot log in to several hosts even though the same credentials work manually. Which configuration change is MOST likely to resolve the issue?

Accepted Answer

Allow the scanner's public key in the authorized_keys file for the scan account. Authenticated SSH scans rely on the scanner presenting a key that the target accepts. When manual logins work but the scanner fails, the usual cause is that the scanner's public key has not been installed in the scan account's authorized_keys file. Adding that key restores authentication without weakening the host's security posture, unlike enabling password authentication or disabling SELinux.

Answer

Enable password authentication on the target hosts

Answer

Change the SSH port on the targets to 2222

Answer

Disable SELinux on the target hosts

Question 11

A penetration tester is planning a web application assessment for a client. The tester wants to combine automated scanning with manual techniques to maximize coverage. Which two actions are MOST appropriate to include in the plan? (Choose two.)

Accepted Answer

Perform manual testing of authentication and session management flows. A thorough web application assessment pairs automated scanning with manual techniques. Automated tools like OWASP ZAP provide broad coverage of common vulnerabilities, while manual testing of authentication and session management uncovers logic and access control flaws that scanners cannot reliably detect. The other options either address infrastructure rather than the application or introduce unnecessary risk without improving coverage.

Answer

Launch a denial-of-service test against the production application to check resilience

Answer

Use a network protocol analyzer to capture all traffic between the tester and the application

Answer

Run a full TCP port scan of the web server before testing the application

Question 12

A vulnerability scan of a production web server reports a critical remote code execution vulnerability, but the system administrator insists the server is fully patched. The scanner used only unauthenticated checks. Which step should the security analyst take FIRST to resolve the discrepancy?

Accepted Answer

Perform an authenticated scan and manually verify the vulnerability on the host. Unauthenticated scans infer vulnerabilities from banners and service responses, which can produce false positives. To resolve the conflict between the scanner and the administrator, the analyst should perform an authenticated scan that reads installed package versions and manually verify the issue on the host. This provides definitive evidence and avoids both unnecessary downtime and premature closure of a critical finding.

Answer

Rescan the server with a different unauthenticated scanner to compare results

Answer

Immediately take the server offline to prevent exploitation

Answer

Accept the administrator's statement and close the finding as a false positive

Question 13

A penetration tester is preparing an authorized internal assessment and must decide how to handle the discovery phase before running exploitation attempts. The client's rules of engagement permit scanning but forbid any action that could cause a denial of service on production hosts. The tester's goal is to map live hosts, open ports, and service versions with minimal impact while still gathering enough data to plan later exploitation. Which approach best satisfies both the engagement constraints and the assessment objective?

Accepted Answer

Perform a phased Nmap discovery using host discovery first, then targeted service/version detection with conservative timing options such as -T2 and limited port ranges, documenting results before any exploitation phase.. The phased approach with host discovery followed by conservative service/version detection controls packet volume and timing, which is what keeps a scan from disrupting production services. Narrowing targets before enumeration also makes later exploitation planning more accurate. Aggressive timing, immediate exploitation, or relying on stale inventory all conflict with either the safety constraint or the objective of verifying live services.

Answer

Skip active scanning entirely and rely only on the client's existing asset inventory spreadsheet, then begin exploitation attempts against the listed hosts.

Answer

Run a full Nmap scan with -sS and no timing adjustments across the entire /16, then immediately launch the exploitation framework against every discovered service.

Answer

Use a single aggressive Nmap scan with -T5 and the default top-1000 ports, then treat every open port as an exploitable finding in the final report.