Scanning, Enumeration, and Vulnerability Assessment
This domain tests structured discovery: finding live hosts, identifying services, enumerating accounts and shares, and turning scan output into validated vulnerabilities. The exam expects you to choose scan types, interpret ambiguous results, and avoid overstating findings.
Core rules and concepts
- Host discovery and port scanning answer different questions; a filtered port is not the same as closed.
- TCP SYN scanning is fast and stealthier than a full connect scan; UDP scanning is slow and often inconclusive, so target likely services.
- Service/version detection and OS fingerprinting guide later enumeration but can be fooled by proxies and banners.
- Enumeration covers SMB shares, LDAP directories, SNMP communities, DNS records, and web virtual hosts. Prefer authenticated scans when credentials are authorized.
- Vulnerability assessment correlates versions, configurations, and missing patches with CVEs, then validates with safe checks. CVSS base score is not the same as business risk.
Worked example
A scan shows TCP 445 open on a file server and SMB signing not required. You enumerate share names with guest access, but do not download files. A scanner flags an SMB vulnerability based on a banner. You verify the OS build and patch level with an authenticated query, then run a non-destructive check. Because the server holds finance data, you rate impact high even if exploitability is moderate, and recommend disabling SMBv1 and requiring signing.
Traps
Do not scan the entire internet because one domain resolves there. Avoid mistaking a web application firewall block for a closed port. Do not paste raw scanner output into a report without validation. Never run exploit checks that can crash a service unless the rules of engagement permit it.