| 🏠 Back to Exam Syllabus | 📺 RooCloud on YouTube | 🌐 RooCloud Practice Exams |
CISSP 15.2 - Performing Vulnerability Assessments (Part 2 of 3)
This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series continues the vulnerability assessment topic from Domain 6, moving past mapping the network into scans that actively probe for known flaws. It is the second of three parts, picking up where port and network mapping left off and turning attention toward finding the real weaknesses that hide behind an open door.
What this episode covers
- Network vulnerability scans — probing past open ports for known flaws using a database of thousands of documented vulnerabilities.
- False positives and false negatives — the harmless false alarm versus the silent miss that gets you breached.
- Zero-day flaws — the undocumented vulnerability that no signature-based scan can ever catch.
- Authenticated scans — logging in with read-only access to read real config and cut both kinds of error.
- Wireless scanning — specialized tools that assess encryption settings and spot rogue access points on the air.
- Web application scanners — dedicated and hybrid tools that probe forms and inputs a network scan would miss.
- When and why to scan — on every new or changed app, on a schedule, and where compliance makes it mandatory.
Watch the full episode above for the worked examples and detailed explanations of each concept.
Frequently Asked Questions
What does a network vulnerability scan add?
It goes past finding open ports and starts probing for known flaws. These tools carry a database of thousands of documented vulnerabilities, along with tests to check whether a system suffers from each one. The result is a ranked list of specific weaknesses on specific systems, so the scanner rattles the handle rather than just noting that a door exists.
How can a scan be wrong in two directions?
Because no automated test is perfect. Sometimes the scanner flags a problem that is not really there, a false positive, which wastes an administrator’s time. Far more dangerous is the false negative, where the scanner stays silent about a flaw that genuinely exists. The false positive annoys you, but the false negative is the one that gets you breached, so treat a clean report with healthy suspicion.
What can no traditional scan ever catch?
A brand-new flaw that nobody has documented yet. Scanners only know what is already in their database, so a vulnerability the vendor has not identified stays invisible. That kind of unknown flaw is a zero-day, and it slips right past ordinary scanning. Scanning is necessary but never sufficient, because the truly novel attack arrives with no signature to match.
How do credentials sharpen a scan?
By letting the scanner log in and look from the inside. By default, scans run without credentials, testing a system the way an outside attacker would, which is useful but shallow and produces more false alarms. Give the scanner read-only access, and it can read the actual configuration, confirm real versions, and cut down on both false positives and false negatives.
Why do web applications need their own kind of scanner?
Because they are exposed by design and dangerously powerful. Web servers must offer services straight to the internet, and firewalls usually wave that traffic through untouched, while the applications behind them often hold privileged access to sensitive databases. A web vulnerability scanner manipulates inputs and parameters like an attacker and uncovers weaknesses that a network scan would sail right past.
📚 Master the ISC2 CISSP Exam!
Ready to test your knowledge? Access chapter-specific Multiple Choice Questions (MCQs) and full-length practice exams for the ISC2 CISSP certification at RooCloud.com. Solve the chapter-wise questions to reinforce this lesson before moving to the next episode.
Reference: This article is based on concepts discussed in CISSP 15.2 - Performing Vulnerability Assessments (Part 2 of 3).