100-160 · Question #59
What is the primary purpose of running a vulnerability scan on your network?
The correct answer is C. To determine whether systems are subject to CVEs that could be exploited by adversaries. A vulnerability scan is an automated test that checks systems and networks for known weaknesses by matching them against a database of vulnerabilities such as CVEs. This allows administrators to identify exploitable conditions before they are leveraged by attackers.
Question
What is the primary purpose of running a vulnerability scan on your network?
Options
- ATo identify and document the locations of customer and financial databases
- BTo automatically prioritize security weaknesses for immediate remediation
- CTo determine whether systems are subject to CVEs that could be exploited by adversaries
- DTo correlate event logs on multiple servers in order to generate intrusion alerts
How the community answered
(46 responses)- A2% (1)
- B4% (2)
- C91% (42)
- D2% (1)
Explanation
A vulnerability scan is an automated test that checks systems and networks for known weaknesses by matching them against a database of vulnerabilities such as CVEs. This allows administrators to identify exploitable conditions before they are leveraged by attackers.
Topics
Community Discussion
5
Orla P.May 9, 2026C, because a scan checks known CVEs against your systems, not log correlation or auto-remediation. Saw this exact question third from the end when I was running low on time, flagged it, came back, and the word "determine" in C locked it in for me instantly.
Prof. SaraApr 28, 2026The word "automatically" in option B is doing a lot of heavy lifting here, and the word "determine" in one of the other options is closer to what a scanner actually outputs. Think about what a vulnerability scanner hands you when it finishes, and ask yourself whether that output tells you what IS happening on your network or what COULD happen, because that distinction cuts right to the heart of why one answer fits and the others belong to different tools entirely. Here is my clarifying question for you: can you name one tool or process from the exam blueprint that handles the job described in option D, and explain in your own words how its output differs from what a vulnerability scanner produces?
Nina C.Apr 29, 2026A network protocol analyzer or an IDS fits option D because its output is actual observed traffic or triggered alerts, not a prioritized list of potential exposures, which is exactly the "is happening" side of the line you are drawing versus what the scanner hands back.
Carlos M.Apr 18, 2026B has to be it, because the whole point of running the scan in the first place is to come out the other side knowing what to fix first, not just to generate a report nobody acts on. A is just asset inventory work, C sounds like what a CVE database lookup does on its own, and D is literally what a SIEM does, not a vuln scanner.
Nina C.Apr 19, 2026Hey Carlos, I get the logic but the answer they're looking for is C, because a vulnerability scanner's core function is actually matching what it finds on your systems against a known vulnerability database, which is exactly that CVE-lookup style comparison you described. Prioritizing remediation, which is what B describes, is a step that comes after the scan, usually handled by a separate risk management or patch management process.