GPEN Vulnerability Scanning Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Configure the scanner to use the Domain Administrator account for full registry access.

  Why it's wrong here

  Domain Administrator accounts provide excessive privileges that violate the principle of least privilege. If the scanner host is compromised, an attacker would gain immediate domain-wide control, significantly increasing the risk profile of the vulnerability scanning infrastructure itself during routine assessment tasks.

• ✗

  Use a local account with no password to allow quick automated authentication.

  Why it's wrong here

  Local accounts without passwords are inherently insecure and are frequently disabled by default security policies. Attempting to use null sessions or blank passwords will likely fail on modern Windows systems, preventing the scanner from accessing necessary APIs to perform a comprehensive vulnerability assessment.

• ✓

  Create a dedicated service account with granular WMI and remote registry permissions.

  Why this is correct

  Dedicated accounts with restricted permissions ensure that the scanner can query the necessary system information without broad administrative access. By limiting the scope of the account to WMI and registry read access, you maintain effective scan quality while significantly reducing overall risk.

• ✗

  Store credentials in plain text in the scanner configuration file for easier automation.

  Why it's wrong here

  Plain text credential storage is a severe security vulnerability that allows anyone with file system access to extract valid administrative passwords. Modern scanners provide encrypted vaults or secure credential managers to protect sensitive data from unauthorized exposure on the scanning host.