GCFA · Question #32
Adam works as a professional Penetration tester. A project has been assigned to him to employ penetration testing on the network of Umbrella Inc. He is running the test from home and had downloaded ev
The correct answer is A. Security scanners are only as smart as their database and cannot find unpublished vulnerabilities. B. Security scanners cannot perform vulnerability linkage. D. Security scanners are not designed to do testing through a firewall.. Security scanners have well-known limitations including database-bound detection, inability to chain vulnerabilities, and poor effectiveness when scanning through firewalls from an external network.
Question
Adam works as a professional Penetration tester. A project has been assigned to him to employ penetration testing on the network of Umbrella Inc. He is running the test from home and had downloaded every security scanner from the Internet. Despite knowing the IP range of all of the systems, and the exact network configuration, Adam is unable to get any useful results. Which of the following is the most like cause of this problem? Each correct answer represents a complete solution. Choose all that apply.
Options
- ASecurity scanners are only as smart as their database and cannot find unpublished vulnerabilities.
- BSecurity scanners cannot perform vulnerability linkage.
- CSecurity scanners are smart as their database and can find unpublished vulnerabilities.
- DSecurity scanners are not designed to do testing through a firewall.
How the community answered
(52 responses)- A71% (37)
- C29% (15)
Why each option
Security scanners have well-known limitations including database-bound detection, inability to chain vulnerabilities, and poor effectiveness when scanning through firewalls from an external network.
Automated scanners rely on signature databases of known vulnerabilities and cannot detect zero-day or unpublished vulnerabilities that have no corresponding entry, leaving significant blind spots.
Security scanners evaluate vulnerabilities individually and cannot perform vulnerability linkage - the technique of chaining multiple low-severity findings together to achieve a higher-impact compromise - which requires human reasoning.
This statement is factually incorrect and directly contradicts choice A - security scanners cannot detect unpublished or zero-day vulnerabilities because they have no signature to match against.
Scanning from a remote home network means all probes must pass through the target organization's perimeter firewall, which will block or filter the scanner's traffic and prevent accurate enumeration of internal services and vulnerabilities.
Concept tested: Limitations of automated security scanners in penetration testing
Source: https://owasp.org/www-project-web-security-testing-guide/stable/3-The_OWASP_Testing_Framework/1-Penetration_Testing_Methodologies
Topics
Community Discussion
No community discussion yet for this question.