GPEN Vulnerability Scanning Practice Question
A penetration tester is reviewing the results of a vulnerability scan and sees a finding labeled 'SSL Certificate Expired' on a web server. The tester confirms that the certificate is indeed expired. What is the most appropriate next step according to typical penetration testing methodology?
⚠ Common exam trap
The trap here is thinking that an expired certificate is directly exploitable or that it should be ignored; it is a reportable misconfiguration, not an exploit vector.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Document the finding, verify its impact, and include it in the final report with remediation recommendations.
The appropriate next step is to document the finding, verify its impact, and include it in the report with remediation recommendations. Expired certificates are configuration issues that can affect security and compliance but are not typically exploitable. The tester should not attempt to exploit or fix the issue unless authorized. Ignoring it would be improper as it is a valid finding.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Document the finding, verify its impact, and include it in the final report with remediation recommendations.
Why this is correct
Penetration testing methodology involves validating findings, assessing their impact, and reporting them with remediation advice. An expired certificate is a configuration issue that can affect user trust and compliance, but it is not typically exploitable. Documenting it and recommending renewal is the correct next step.
- ✗
Attempt to renew the certificate yourself to fix the issue.
Why it's wrong here
Penetration testers should not make changes to production systems unless explicitly authorized and part of the engagement scope. Renewing the certificate is a remediation action that should be performed by the system owner. The tester's role is to report, not to fix, unless remediation is contracted.
- ✗
Immediately exploit the expired certificate to gain unauthorized access.
Why it's wrong here
An expired certificate does not provide an exploitable vulnerability by itself; it typically causes browser warnings but does not allow unauthorized access. Exploiting it would not yield access and is not a valid penetration testing step. The finding should be reported as a misconfiguration, not an exploit target.
- ✗
Ignore the finding because expired certificates are not security vulnerabilities.
Why it's wrong here
Expired certificates are security-relevant because they can lead to man-in-the-middle attacks if users bypass warnings, and they may violate compliance standards. Ignoring the finding would miss an opportunity to improve security posture. It should be reported even if it is not directly exploitable.
About these practice questions
Courseiva writes every GPEN question from scratch — 298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GPEN practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GPEN exam.