Which activity uses automated scanners to identify known weaknesses in systems?

• A. Vulnerability assessment
• B. Penetration testing
• C. Security auditing
• D. Compliance checks

Answer: (A)

Using automated scanners to identify known weaknesses in systems is vulnerability assessment. These tools automatically scan networks, hosts, and applications against databases of known issues (like CVEs and common misconfigurations) to find missing patches, insecure settings, weak credentials, open ports, and other vulnerabilities. The output is a prioritized report that guides remediation, focusing on what is known to be risky.

Penetration testing goes a step further by actively trying to exploit discovered weaknesses to prove they can be leveraged, under controlled conditions. Security auditing examines whether security controls and processes are in place and functioning, often against standards, and may include automated checks but isn’t solely about finding system weaknesses. Compliance checks verify adherence to specific policies or regulations.