CISSP Security Assessment and Testing Practice Question
A security analyst is conducting a vulnerability scan of a web application. The scan identifies several vulnerabilities, but the analyst wants to minimize false positives. Which type of vulnerability scan would be most appropriate?
⚠ Common exam trap
It's easy for candidates to assume an unauthenticated scan is more thorough because it tests from an attacker's perspective, but they miss that authenticated scans provide the internal visibility needed to eliminate false positives by verifying actual patch levels and configurations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authenticated scan
An authenticated scan uses valid credentials to log into the target system, allowing the scanner to access deeper configuration details and patch levels. This reduces false positives by distinguishing between vulnerabilities that are actually present and those that appear due to incomplete visibility, such as missing patches that are actually applied but not visible to an unauthenticated scanner.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
External scan
Why it's wrong here
An external scan is conducted from outside the organization's network perimeter, simulating an attacker's perspective on internet-facing assets. While effective for identifying network-level vulnerabilities like open ports, misconfigured firewalls, or exposed services, it typically lacks the internal access or credentials required to thoroughly assess vulnerabilities within web applications or internal systems, which often require authenticated access to reveal deeper flaws.
- ✗
Passive scan
Why it's wrong here
A passive scan monitors network traffic and application responses without actively sending malicious payloads or probing for weaknesses. This method can identify certain vulnerabilities, such as insecure HTTP headers, exposed sensitive information in responses, or outdated server banners. However, it cannot uncover vulnerabilities that require active interaction, like SQL injection, cross-site scripting (XSS), or authentication bypasses, as it doesn't manipulate inputs or states.
- ✓
Authenticated scan
Why this is correct
An authenticated scan is performed with valid user credentials, allowing the scanner to interact with the application as a legitimate, logged-in user. This approach provides a comprehensive view of vulnerabilities, including those in protected areas, authorization flaws, and business logic issues that are only accessible post-authentication. By simulating a real user, it significantly reduces false positives and offers a more accurate security posture assessment of the application's internal workings.
- ✗
Unauthenticated scan
Why it's wrong here
An unauthenticated scan attempts to find vulnerabilities without providing any login credentials, simulating an attacker who has not yet gained access to the system. While effective for discovering publicly exposed weaknesses like default credentials, misconfigured public services, or vulnerabilities on login pages, it cannot access or test the vast majority of an application's functionality or data that resides behind an authentication barrier, leading to a significant blind spot for internal application flaws.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.