GPEN Vulnerability Scanning Practice Question
A penetration tester has completed an unauthenticated vulnerability scan of a web server and received a report listing several critical CVEs. Before including these in the final report, the tester wants to validate that the findings are not false positives. Which action is the MOST appropriate next step?
⚠ Common exam trap
The trap here is thinking that rescanning or using another tool validates a finding, when only direct manual confirmation proves the vulnerability exists.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Manually verify the finding by checking the actual service version and testing the vulnerability.
Manual verification is the gold standard for confirming scanner findings. By directly checking the service version, inspecting configuration, or safely testing the vulnerability, the tester obtains evidence that the issue is real. This eliminates false positives and ensures the report is accurate. Other options either do not validate the specific finding or risk reporting unverified critical issues.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Lower the scan's severity threshold and rescan to see if more issues appear.
Why it's wrong here
Changing severity thresholds does not validate existing findings; it only affects which findings are displayed. Rescanning with a lower threshold might reveal additional issues but does nothing to confirm the critical CVEs already identified. This action diverts from the goal of verifying the specific critical findings, so it is not the most appropriate next step.
- ✗
Re-run the scan with a different scanner and compare results.
Why it's wrong here
Running a second scanner can provide corroboration, but it is not the most direct validation step. Different scanners may use different detection logic and produce different false positives or negatives, leading to confusion. The most reliable validation is manual verification of the specific finding. Therefore this is not the best immediate action for confirming a critical CVE.
- ✓
Manually verify the finding by checking the actual service version and testing the vulnerability.
Why this is correct
Manual verification, such as banner grabbing, checking file versions, or safely reproducing the vulnerability, provides definitive proof. Scanners infer vulnerabilities from version strings or indirect indicators, which can be wrong. By directly inspecting the service and testing the specific issue, the tester eliminates false positives and can confidently report the finding with evidence.
- ✗
Assume the scanner is correct and include the finding as critical.
Why it's wrong here
Including unverified critical findings can damage the tester's credibility if they turn out to be false positives. Professional penetration testing requires validating findings before reporting. Assuming correctness is risky because scanners often produce false positives due to version backporting, misidentification, or plugin errors. This approach is not appropriate for a final report.
About these practice questions
This GPEN question is part of Courseiva's 298-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GPEN practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GPEN exam.