mediumMultiple SelectObjective-mapped
Vulnerability Assessment Activities: Identification vs Exploitation
A company is conducting a security assessment of its network infrastructure. Which of the following activities are typically performed during a vulnerability assessment? (Select TWO.)
Quick Answer
The correct answer is automated scanning of open ports and services, because vulnerability assessment activities focus on identification rather than exploitation. Unlike penetration testing, which actively attempts to breach systems, a vulnerability assessment uses automated tools like Nessus or OpenVAS to catalog weaknesses—such as missing patches or misconfigurations—by comparing system states against known vulnerability databases like CVE. On the CISSP exam, this distinction tests your understanding of the assessment lifecycle: vulnerability assessments are broad, non-intrusive scans that produce a list of potential issues, while penetration testing is a targeted, often manual effort to validate exploitability. A common trap is confusing the two; remember that exploitation is the goal of a pen test, not a vulnerability assessment. Memory tip: “Vulnerability assessment finds the holes; penetration testing tries to climb through them.”
⚠ Common exam trap
Candidates often confuse vulnerability assessment (identification only) with penetration testing (identification plus exploitation), leading candidates to select 'Exploiting identified vulnerabilities to gain unauthorized access' as a correct activity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identification of missing security patches
A is correct because vulnerability assessments focus on identifying and cataloging weaknesses without exploitation. Missing security patches are a common finding from automated scanning tools like Nessus or OpenVAS, which compare system configurations against known vulnerability databases (e.g., CVE). This aligns with the assessment's goal of discovering vulnerabilities, not exploiting them.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Identification of missing security patches
Why this is correct
Patch identification is a key component of vulnerability assessment.
- ✗
Attempting to crack password hashes
Why it's wrong here
Password cracking is a post-exploitation activity in penetration testing.
- ✗
Social engineering attacks against employees
Why it's wrong here
Social engineering is a separate assessment type.
- ✗
Exploiting identified vulnerabilities to gain unauthorized access
Why it's wrong here
Exploitation is performed during penetration testing, not vulnerability assessment.
- ✓
Automated scanning of open ports and services
Why this is correct
Port scanning is a routine vulnerability assessment activity.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security assessment
A security assessment is a systematic evaluation of an organization’s systems, networks, and applications to identify vulnerabilities, threats, and risks, and to recommend improvements.
Key term
Vulnerability assessment
A vulnerability assessment is a systematic review of security weaknesses in an information system, evaluating if the system is susceptible to any known vulnerabilities, assigning severity levels, and recommending remediation or mitigation.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
6 more ways this is tested on CISSP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE of the following are common methods used in security assessment and testing? (Select exactly 3.)
hard- A.Risk analysis
- ✓ B.Penetration testing
- ✓ C.Security auditing
- D.Forensic analysis
- ✓ E.Vulnerability scanning
Why B: Penetration testing is a common method in security assessment and testing that simulates real-world attacks to identify exploitable vulnerabilities. Unlike vulnerability scanning, which only identifies potential weaknesses, penetration testing actively exploits them to validate security controls and measure the impact of a breach.
Variation 2. Match each security assessment type to its description.
medium- ✓ A.Vulnerability Assessment: Automated scan to identify known vulnerabilities
- ✓ B.Penetration Test: Simulated attack to exploit vulnerabilities and assess impact
- ✓ C.Security Audit: Review of policies, procedures, and controls against standards
- ✓ D.Risk Assessment: Identification and evaluation of risks to assets
- E.Vulnerability Assessment: Simulated attack to exploit vulnerabilities and assess impact
- F.Penetration Test: Automated scan to identify known vulnerabilities
Why A: Correct matches: Vulnerability Assessment uses automated scans; Penetration Test involves exploitation; Security Audit reviews policies; Risk Assessment evaluates risks. Common confusions mix vulnerability assessments with penetration tests.
Variation 3. Which TWO of the following are key objectives of a security assessment? (Select exactly 2.)
medium- ✓ A.Identify vulnerabilities in systems and applications.
- ✓ B.Assess the effectiveness of existing security controls.
- C.Exploit vulnerabilities to gain unauthorized access.
- D.Prioritize threats based on business impact.
- E.Implement new security controls to address findings.
Why A: A is correct because identifying vulnerabilities is a primary objective of a security assessment, such as a vulnerability scan or penetration test, which systematically discovers weaknesses in systems and applications (e.g., missing patches, misconfigurations, or insecure code). B is correct because assessing the effectiveness of existing security controls (e.g., firewalls, IDS/IPS, access controls) is a core goal, often achieved through control testing or validation to determine if controls are properly implemented and functioning as intended.
Variation 4. Which of the following is the primary purpose of a security assessment?
easy- ✓ A.To identify and evaluate security risks
- B.To fix all vulnerabilities
- C.To achieve compliance with regulations
- D.To punish non-compliant employees
Why A: A security assessment's primary purpose is to systematically identify and evaluate security risks by analyzing assets, threats, vulnerabilities, and existing controls. This aligns with the NIST SP 800-115 framework, which defines assessment as the process of determining how effectively an entity is meeting specific security objectives, not as a remediation or enforcement activity.
Variation 5. Which of the following is the primary purpose of a security assessment?
easy- A.To fix all vulnerabilities immediately
- B.To ensure compliance with regulations
- C.To punish non-compliant employees
- ✓ D.To identify weaknesses and measure control effectiveness
Why D: The primary purpose of a security assessment is to systematically identify vulnerabilities, threats, and weaknesses in an organization's information systems, and to evaluate the effectiveness of existing security controls. This aligns with the CISSP domain of Security Assessment and Testing, where the goal is to measure control performance against a baseline, not to immediately remediate or enforce compliance.
Variation 6. Which TWO of the following are examples of types of security assessments?
medium- ✓ A.Vulnerability scan
- B.Firewall rule review
- C.Password policy enforcement
- D.Antivirus update
- ✓ E.Penetration test
Why A: Vulnerability scans and penetration tests are two primary types of security assessments. A vulnerability scan (Option A) is an automated, non-intrusive assessment that identifies known vulnerabilities and misconfigurations. A penetration test (Option E) is an active assessment where security professionals attempt to exploit vulnerabilities to evaluate the security of an environment. Firewall installation (Option B), password policy enforcement (Option C), and antivirus updates (Option D) are operational security controls and maintenance activities, not security assessments.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.