Vulnerability Scans

Question 1

Credentialed vs Non-Credentialed (Vulnerability Scan)

Answer 1

Credentialed
* scanner uses an authorized user or admin account
* closer to system admin perspective
* deeper scan, more vulnerabilities
Non Credentialed
* scanner without admin account
* closer to hacker perspective

Question 2

Discovery Scan (Vulnerability Scan)

Answer 2

• least intrusive (like ping sweep)

* used to create entwork map to show connected devices in architecture

Question 3

Full Scan (Vulnerability Scan)

Answer 3

• in depth scan including port, services and vulnerabilities

* easy to see in network traffic when performed

Question 4

Stealth Scan (Vulnerability Scan)

Answer 4

• scans by sending SYN packet and then analyzing the response
• if SYN/ACK is received, destination is trying to establish the connection (port is open) and scanner sends RST packet

Question 5

Compliance Scan (Vulnerability Scan)

Answer 5

• identify vulnerabilities that may affect compliance with regulations
• commonly setup as a scanning template in vulnerability scanner (like PCI DSS)