Which type of assessment does an ethical hacker perform to expose weaknesses in a system?

Which type of assessment does an ethical hacker perform to expose weaknesses in a system?

• A. Penetration testing
• B. Vulnerability assessment
• C. Risk assessment
• D. Compliance assessment

Answer: (B)

The main idea here is distinguishing how weaknesses are identified in a system. A vulnerability assessment is the process focused on finding and cataloging security gaps, misconfigurations, missing patches, and other weaknesses using scans, checks, and reviews. The goal is to create a prioritized list of vulnerabilities so defenders can remediate them and reduce risk. It shows what exists and where, without necessarily trying to exploit those weaknesses. Penetration testing, on the other hand, goes a step further by actively attempting to exploit the identified vulnerabilities to demonstrate real-world impact and whether an attacker could gain access or move laterally. While that also reveals weaknesses, it’s about proof of exploitability and impact, not just discovery. Risk assessment and compliance assessment serve different purposes: risk assessment weighs the likelihood and impact of threats given vulnerabilities, and compliance assessment checks adherence to standards and regulations. So, when the task is to expose weaknesses by identifying and listing them for remediation, vulnerability assessment is the best fit.

The main idea here is distinguishing how weaknesses are identified in a system. A vulnerability assessment is the process focused on finding and cataloging security gaps, misconfigurations, missing patches, and other weaknesses using scans, checks, and reviews. The goal is to create a prioritized list of vulnerabilities so defenders can remediate them and reduce risk. It shows what exists and where, without necessarily trying to exploit those weaknesses.

Penetration testing, on the other hand, goes a step further by actively attempting to exploit the identified vulnerabilities to demonstrate real-world impact and whether an attacker could gain access or move laterally. While that also reveals weaknesses, it’s about proof of exploitability and impact, not just discovery.

Risk assessment and compliance assessment serve different purposes: risk assessment weighs the likelihood and impact of threats given vulnerabilities, and compliance assessment checks adherence to standards and regulations.

So, when the task is to expose weaknesses by identifying and listing them for remediation, vulnerability assessment is the best fit.