Vulnerability Assessment Tools & Techniques Flashcards

Which technique involves sending packets with unusual flag combinations (e.g., all flags set) to elicit responses that reveal firewall or OS behavior?

Answer: Xmas scan

An Xmas scan sets FIN, PSH, and URG flags simultaneously; RFC-compliant closed ports respond with RST while open ports remain silent, helping map firewall rules.

A security team wants to discover all assets on a network before scanning for vulnerabilities. Which process describes this step?

Answer: Asset discovery / enumeration

Asset discovery (enumeration) identifies all live hosts, IP addresses, and services on the network before vulnerability scanning begins.

What is the role of the Common Vulnerability Scoring System (CVSS) in vulnerability assessment?

Answer: Providing a standardized numerical score reflecting vulnerability severity

CVSS provides a standardized framework with a 0–10 score that quantifies the severity of a vulnerability based on exploitability, impact, and environmental factors.

Which Nessus feature allows policies to be saved and reused across multiple scans to ensure consistency?

Answer: Scan templates

Scan templates in Nessus store pre-configured settings including credentials, plugin selections, and targets so the same policy can be applied consistently to future scans.

During a vulnerability assessment, an assessor identifies a CVE with a CVSS base score of 9.8. How should this finding be prioritized?

Answer: Critical priority — remediate immediately or apply compensating controls

A CVSS base score of 9.8 is rated Critical (9.0–10.0), indicating high exploitability and impact, requiring immediate attention and remediation.

What is the key difference between a vulnerability scanner and a penetration testing tool?

Answer: Vulnerability scanners identify weaknesses without exploiting them; penetration tools actively exploit

Vulnerability scanners detect and report potential weaknesses passively, while penetration testing tools attempt to actively exploit those weaknesses to confirm their impact.

Which command-line tool can be used to capture network packets and analyze traffic for potential security issues during an assessment?

Answer: Tcpdump

Tcpdump captures and displays network packet data in real time from the command line, enabling traffic analysis for cleartext credentials, unusual protocols, or suspicious patterns.