Vulnerability scanning versus penetration testing
Name:
Date:
Class:
A
Quick Questions
Shade in the A or B circle for each question.
1. Which tool automatically checks systems and lists known weaknesses?
2. Which activity tries to exploit weaknesses to show the real impact of an attack?
3. Which is mostly automated and which is mostly manual?
4. A scanner reports a weakness that does not actually exist on the system. What is this called?
5. How can a team confirm whether a scan result is a false positive?
B
Match the Pairs
Draw a line connecting each item on the left to its match on the right.
| Left column | Right column | |
|---|---|---|
| 1nmap -sV 192.168.1.10 | AScans can return false positives, so items in the report must be checked and verified by a person before being treated as real. | |
| 2Scan result: "Possible SQL injection" - tester confirms it is not exploitable | BA scan only lists possible known weaknesses. It does not exploit them, so it cannot prove real data theft. Proving impact needs a penetration test. | |
| 3A vulnerability scan is automated and produces a list of known weaknesses without exploiting them | CAn automated scan that probes a host and lists open ports and service versions, which can then be checked against known vulnerabilities | |
| 4A penetration test is manual: a tester tries to exploit a weakness to show the real impact | Dscan_report = run_scanner(target) # lists issues only | |
| 5"Our vulnerability scan proved attackers could steal customer data." | EA false positive: the scan flagged a weakness that does not really exist, so a person must verify it | |
| 6"Every item in the scan report is a confirmed, real vulnerability." | Fexploit(target, "weak_admin_login") # tester gains access |
C
Definitions
vulnerability scan vs penetration test
D
Fill in the Blanks
Complete each line of code by filling in the missing parts.
1.
Vulnerability ____: automated check
Output: list of known weaknesses
2.
Penetration test: ______ work by testers
Goal: exploit weaknesses to show impact
3.
A scan reports a weakness that is not real:
This is called a ______________.
4.
Scan finds a weakness.
Tester tries to _______ it to prove impact.
5.
A ________________ proves real impact.
A scan only lists known weaknesses.
E
Spot the Error
Shade in the letter of the line that contains an error.
Question 1
A
scan = Scanner("automated")
B
found = scan.run(server)
C
print("Exploited:", found)
Question 2
A
vulns = Scanner().run(server)
B
tester = Tester("manual")
C
for v in vulns:
D
tester.list(v)
Question 3
A
scan_type = "manual"
B
if scan_type == "automated":
C
print("Lists known flaws")
Question 4
A
flag = scan.finding("SQLi")
B
confirmed = tester.verify(flag)
C
if not confirmed:
D
status = "real exploit"
Question 5
A
alerts = scan.run(server)
B
real = alerts
C
print(len(real))
Answer Key
Vulnerability scanning versus penetration testing
Section A: Quick Questions
Q1
A — A vulnerability scan
Q2
B — A penetration test
Q3
A — Scan is automated; penetration test is manual
Q4
B — A false positive
Q5
A — Manually verify it, for example by trying to exploit it
Section B: Match the Pairs
Q1
nmap -sV 192.168.1.10 → An automated scan that probes a host and lists open ports and service versions, which can then be checked against known vulnerabilities
Q2
Scan result: "Possible SQL injection" - tester confirms it is not exploitable → A false positive: the scan flagged a weakness that does not really exist, so a person must verify it
Q3
A vulnerability scan is automated and produces a list of known weaknesses without exploiting them → scan_report = run_scanner(target) # lists issues only
Q4
A penetration test is manual: a tester tries to exploit a weakness to show the real impact → exploit(target, "weak_admin_login") # tester gains access
Q5
"Our vulnerability scan proved attackers could steal customer data." → A scan only lists possible known weaknesses. It does not exploit them, so it cannot prove real data theft. Proving impact needs a penetration test.
Q6
"Every item in the scan report is a confirmed, real vulnerability." → Scans can return false positives, so items in the report must be checked and verified by a person before being treated as real.
Section C: Definitions
Q1
vulnerability scan vs penetration test — A vulnerability scan is an automated check that lists known weaknesses, some false positives. A penetration test is manual: testers try to exploit them to prove the real impact.Section D: Fill in the Blanks
Q1
Vulnerability scan: automated check
Output: list of known weaknessesQ2
Penetration test: manual work by testers
Goal: exploit weaknesses to show impactQ3
A scan reports a weakness that is not real:
This is called a false positive.Q4
Scan finds a weakness.
Tester tries to exploit it to prove impact.Q5
A penetration test proves real impact.
A scan only lists known weaknesses.Section E: Spot the Error
Q1
C — A vulnerability scan only lists known weaknesses. It does not exploit them, so the output should be labelled "Known:", not "Exploited:".
Q2
D — A penetration test tries to exploit each weakness to show real impact. Only listing it is what a scan does, so the line should be tester.exploit(v).
Q3
A — A vulnerability scan is automated software, so scan_type should be "automated". Manual work is what penetration testers do.
Q4
D — If a tester cannot confirm a scan finding, it is a false positive: the scanner reported a weakness that is not really there. It should be "false positive".
Q5
B — Scans can produce false positives, so alerts must be checked manually before they are treated as real. Assigning real = alerts skips that check.