Which of the following is commonly done as part of a vulnerability scan?

Exploiting misconfigured applications is characteristic of penetration testing, which actively attempts to breach systems, rather than a non-intrusive vulnerability scan.

Cracking employee passwords is typically part of a password audit or a penetration test, not a standard function of a vulnerability scan.

Sending phishing emails is a social engineering technique used in penetration testing or security awareness training, which is distinct from a technical vulnerability scan.

Vulnerability scans are designed to identify known security flaws, such as missing security updates, unpatched software, or misconfigurations on workstations and servers. These scans compare system information against databases of known vulnerabilities to flag systems that are susceptible to attack due to a lack of proper patching.