Vulnerability assessment

A vulnerability assessment is the systematic identification, quantification, and ranking of weaknesses across systems, networks, and applications, usually driven by automated scanners that check configurations and software versions against databases of known flaws. The output is a prioritised list, typically scored with CVSS, that tells an organisation where it is exposed and which fixes matter most. Assessments favour breadth over depth: every host in scope gets examined, but nothing gets attacked.

The caveat that decides answers is validation. Scanners report false positives, flagging weaknesses that are unexploitable or already mitigated, so raw results need human verification before remediation budgets follow them. An assessment also proves nothing about exploitability: a critical finding may be unreachable in practice, and a modest one may chain into full compromise. Recurring scan results also feed risk reporting, where the trend in overdue findings can serve as a key risk indicator of a weakening security posture.

Exam relevance: if a scenario mentions scanning, ranking, or cataloguing weaknesses without exploiting them, the answer is vulnerability assessment. If it demands proof that a flaw is actually exploitable, the answer is penetration testing. The distinction is depth: assessments produce a wide list of suspects, penetration tests convict a few of them. When a question asks what to do with scanner output first, the answer is validate the findings.