mediumMultiple Select
Vulnerability Assessment Activities: Identification vs Exploitation
A company is conducting a security assessment of its network infrastructure. Which of the following activities are typically performed during a vulnerability assessment? (Select TWO.)
Quick Answer
The correct answer is automated scanning of open ports and services, because vulnerability assessment activities focus on identification rather than exploitation. Unlike penetration testing, which actively attempts to breach systems, a vulnerability assessment uses automated tools like Nessus or OpenVAS to catalog weaknesses—such as missing patches or misconfigurations—by comparing system states against known vulnerability databases like CVE. On the CISSP exam, this distinction tests your understanding of the assessment lifecycle: vulnerability assessments are broad, non-intrusive scans that produce a list of potential issues, while penetration testing is a targeted, often manual effort to validate exploitability. A common trap is confusing the two; remember that exploitation is the goal of a pen test, not a vulnerability assessment. Memory tip: “Vulnerability assessment finds the holes; penetration testing tries to climb through them.”
⚠ Common exam trap
Candidates often confuse vulnerability assessment (identification only) with penetration testing (identification plus exploitation), leading candidates to select 'Exploiting identified vulnerabilities to gain unauthorized access' as a correct activity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identification of missing security patches
Option A is correct because a vulnerability assessment catalogs known weaknesses such as missing security patches by comparing installed software versions against vendor advisories and CVE databases. Option E is correct because automated scanners (e.g., Nessus, Qualys, OpenVAS) enumerate open ports and fingerprint running services to identify potential exposures, which is a core assessment activity. Option B does not belong because cracking password hashes is a penetration-testing/attack activity that attempts to exploit credentials rather than merely identify weaknesses. Option C is incorrect because social engineering targets people and falls under penetration testing or red-team engagements, not technical vulnerability scanning. Option D is incorrect because actively exploiting vulnerabilities to gain unauthorized access defines penetration testing, whereas a vulnerability assessment only identifies and reports them.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Identification of missing security patches
Why this is correct
Vulnerability assessment inventories known weaknesses, and missing security patches are a primary finding because unpatched software exposes documented CVEs. Identifying them satisfies the stem's requirement for a typical vulnerability assessment activity, without exploiting the flaws as a penetration test would.
- ✗
Attempting to crack password hashes
Why it's wrong here
Password hash cracking actively exploits weak credentials, which belongs to penetration testing rather than vulnerability assessment, whose scope is identifying and enumerating weaknesses without exploitation. It is tempting because weak passwords are genuine vulnerabilities, and hash cracking would be correct within an authorised penetration test or red-team engagement.
- ✗
Social engineering attacks against employees
Why it's wrong here
Social engineering manipulates people to disclose information or grant access, an exploitation technique outside vulnerability assessment's technical identification scope. It is tempting because human weakness is a real vulnerability class, and social engineering would be correct during a penetration test or red-team exercise targeting personnel.
- ✗
Exploiting identified vulnerabilities to gain unauthorized access
Why it's wrong here
Exploiting vulnerabilities to gain unauthorised access is penetration testing; vulnerability assessment identifies and reports weaknesses without attempting exploitation. It is tempting because exploitation confirms whether a finding is genuinely exploitable, and it would be correct within an authorised penetration test or red-team engagement.
- ✓
Automated scanning of open ports and services
Why this is correct
Automated scanning enumerates open ports and listening services, building the asset and exposure inventory on which vulnerability assessment depends. This discovery step is standard practice, satisfying the stem's request for typical vulnerability assessment activities rather than exploitation or control testing.
Go deeper
Related to this question
Learn chapter
Access Control Models and Mechanisms
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
Penetration testing
Penetration testing is a simulated cyberattack on a computer system, network, or application to find security weaknesses before real attackers can exploit them.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
6 more ways this is tested on CISSP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE of the following are common methods used in security assessment and testing? (Select exactly 3.)
hard- A.Risk analysis
- ✓ B.Penetration testing
- ✓ C.Security auditing
- D.Forensic analysis
- ✓ E.Vulnerability scanning
Why B: Penetration testing is a common method in security assessment and testing that simulates real-world attacks to identify exploitable vulnerabilities. Unlike vulnerability scanning, which only identifies potential weaknesses, penetration testing actively exploits them to validate security controls and measure the impact of a breach.
Variation 2. Match each security assessment type to its description.
medium- ✓ A.Vulnerability Assessment: Automated scan to identify known vulnerabilities
- ✓ B.Penetration Test: Simulated attack to exploit vulnerabilities and assess impact
- ✓ C.Security Audit: Review of policies, procedures, and controls against standards
- ✓ D.Risk Assessment: Identification and evaluation of risks to assets
- E.Vulnerability Assessment: Simulated attack to exploit vulnerabilities and assess impact
- F.Penetration Test: Automated scan to identify known vulnerabilities
Why A: Correct matches: Vulnerability Assessment uses automated scans; Penetration Test involves exploitation; Security Audit reviews policies; Risk Assessment evaluates risks. Common confusions mix vulnerability assessments with penetration tests.
Variation 3. Which TWO of the following are key objectives of a security assessment? (Select exactly 2.)
medium- ✓ A.Identify vulnerabilities in systems and applications.
- ✓ B.Assess the effectiveness of existing security controls.
- C.Exploit vulnerabilities to gain unauthorized access.
- D.Prioritize threats based on business impact.
- E.Implement new security controls to address findings.
Why A: A is correct because identifying vulnerabilities is a primary objective of a security assessment, such as a vulnerability scan or penetration test, which systematically discovers weaknesses in systems and applications (e.g., missing patches, misconfigurations, or insecure code). B is correct because assessing the effectiveness of existing security controls (e.g., firewalls, IDS/IPS, access controls) is a core goal, often achieved through control testing or validation to determine if controls are properly implemented and functioning as intended.
Variation 4. Which of the following is the primary purpose of a security assessment?
easy- ✓ A.To identify and evaluate security risks
- B.To fix all vulnerabilities
- C.To achieve compliance with regulations
- D.To punish non-compliant employees
Why A: A security assessment's primary purpose is to systematically identify and evaluate security risks by analyzing assets, threats, vulnerabilities, and existing controls. This aligns with the NIST SP 800-115 framework, which defines assessment as the process of determining how effectively an entity is meeting specific security objectives, not as a remediation or enforcement activity.
Variation 5. Which of the following is the primary purpose of a security assessment?
easy- A.To fix all vulnerabilities immediately
- B.To ensure compliance with regulations
- C.To punish non-compliant employees
- ✓ D.To identify weaknesses and measure control effectiveness
Why D: The primary purpose of a security assessment is to systematically identify vulnerabilities, threats, and weaknesses in an organization's information systems, and to evaluate the effectiveness of existing security controls. This aligns with the CISSP domain of Security Assessment and Testing, where the goal is to measure control performance against a baseline, not to immediately remediate or enforce compliance.
Variation 6. Which TWO of the following are examples of types of security assessments?
medium- ✓ A.Vulnerability scan
- B.Firewall rule review
- C.Password policy enforcement
- D.Antivirus update
- ✓ E.Penetration test
Why A: A vulnerability scan (A) is a recognized type of security assessment because it systematically probes hosts, services, and applications for known weaknesses using signature/CVE-based checks, producing a report of findings. A penetration test (E) is also a security assessment type, as it goes beyond scanning by actively exploiting vulnerabilities under a defined scope and rules of engagement to demonstrate real-world impact. The other options are operational or administrative controls rather than assessment types: a firewall rule review (B) is a configuration audit of one control, password policy enforcement (C) is a preventive administrative control, and antivirus update (D) is routine maintenance of a protective tool.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.