What process does an organization perform to identify vulnerabilities in its network and security systems?

What process does an organization perform to identify vulnerabilities in its network and security systems?

• A. Penetration testing
• B. Risk assessment
• C. Vulnerability scanning
• D. Threat modeling

Answer: (B)

Vulnerability scanning is the process that identifies weaknesses in a network and security systems. It uses automated tools to inventory hosts and services and then checks them against known vulnerability databases, flagging missing patches, misconfigurations, and other flaws so you can remediate them. This is different from risk assessment, which looks at the overall risk posture by evaluating the likelihood and impact of threats and often uses identified vulnerabilities as inputs, rather than performing the scanning itself. Penetration testing goes further by attempting to exploit vulnerabilities to prove they can be used, while threat modeling focuses on identifying potential attack paths during design. So, the activity that directly identifies weaknesses in the system is vulnerability scanning.

Vulnerability scanning is the process that identifies weaknesses in a network and security systems. It uses automated tools to inventory hosts and services and then checks them against known vulnerability databases, flagging missing patches, misconfigurations, and other flaws so you can remediate them. This is different from risk assessment, which looks at the overall risk posture by evaluating the likelihood and impact of threats and often uses identified vulnerabilities as inputs, rather than performing the scanning itself. Penetration testing goes further by attempting to exploit vulnerabilities to prove they can be used, while threat modeling focuses on identifying potential attack paths during design. So, the activity that directly identifies weaknesses in the system is vulnerability scanning.