Start your lesson
Study the required lesson for each block, then take its short check. Guided exercises are optional. Required case practice within the blocks counts toward the readiness checklist, not lesson completion.
Your notesPrivate to you
Block 1 of 6Credentialed vulnerability scan · Uncredentialed vulnerability scan · Scan scope · Scan rate limit
Practice savedNext · 15 min
Credentialed vulnerability scan · Uncredentialed vulnerability scan · Scan scope · Scan rate limit
Practice savedNo provider lesson is assigned to this block. Study the ITForMe lesson below, then take the required check.
Required ITForMe lesson
Concept notes
Credentialed vulnerability scan
Authenticates to a target to inspect local packages, configurations, and patch state that remote observation may not expose.
Uncredentialed vulnerability scan
Assesses a target without authenticating to it, so results emphasize remotely reachable services and observable behavior from wherever the scanner is placed.
Scan scope
Defines authorized targets, addresses, environments, exclusions, methods, timing, and owners for a vulnerability assessment.
Scan rate limit
Bounds probe concurrency or request frequency to reduce assessment load and disruption risk on target systems.
Required block check · Block 1
Required for course progress · Pass with 3 of 4 correct
Block 2 of 6Passive asset discovery · Active vulnerability scanning · Web application assessment · Scan stop condition
Practice saved15 min
Passive asset discovery · Active vulnerability scanning · Web application assessment · Scan stop condition
Practice savedNo provider lesson is assigned to this block. Study the ITForMe lesson below, then take the required check.
Required ITForMe lesson
Concept notes
Passive asset discovery
Observes existing network traffic to identify communicating assets without sending probes, but cannot establish the state of silent devices.
Active vulnerability scanning
Sends requests or probes to targets to identify services and conditions, creating traffic and possible operational impact.
Web application assessment
Evaluates application routes, inputs, sessions, authorization, and server behavior within an approved scope and test method.
Scan stop condition
Specifies a measurable health or safety signal and authorized contact that require potentially disruptive testing to pause.
Required block check · Block 2
Required for course progress · Pass with 3 of 4 correct
Block 3 of 6Define safe scan scope and credentials
Practice saved8 min
Define safe scan scope and credentials
Practice savedNo provider lesson is assigned to this block. Study the ITForMe lesson below, then take the required check.
Required ITForMe lesson
Define safe scan scope and credentials
By the end, you can
- Analyze supplied evidence for credentialed-scan coverage.
- Analyze supplied evidence for scan-method complement.
A vulnerability scan needs written scope, authorized source, time window, rate limits, exclusions, and an owner for unexpected impact. Discovery can identify live assets before deeper checks, but results must be reconciled with inventory because firewalls, sleep states, and transient cloud assets create blind spots.
Credentialed scanning inspects local packages and configuration with an approved least-privilege account. Uncredentialed scanning observes what a remote peer can reach. Neither method replaces the other, and credential failure must be reported as a coverage problem rather than as a clean host.
Worked example
A scan of 120 managed servers reports zero findings on 18 hosts; the scanner log shows authentication failed for those same hosts.
- Scope: servers app-001 through app-120
- Scan summary: 102 authenticated, 18 authentication failed
- Finding summary: zero findings on all 18 failed hosts
The eighteen results lack credentialed coverage. Zero findings cannot be interpreted as zero vulnerabilities.
Repair the scan credential path and rescan the 18 hosts; expect authenticated coverage or an explicit documented exception.
Reasoning self-check
A scan of 120 managed servers reports zero findings on 18 hosts; the scanner log shows authentication failed for those same hosts.
- Scope: servers app-001 through app-120
- Scan summary: 102 authenticated, 18 authentication failed
- Finding summary: zero findings on all 18 failed hosts
- Record a timestamped fact table from the supplied evidence.
- Test the two most plausible explanations against every observation.
- Choose a bounded defensive action and state the result that would confirm it worked.
Compare your reasoning
Expected answers
- Repair the scan credential path and rescan the 18 hosts; expect authenticated coverage or an explicit documented exception.
- The conclusion cites at least two supplied observations and names one remaining uncertainty.
If you got stuck
- If the evidence conflicts, preserve both records and check clock, scope, and collection gaps before deciding.
- If no conclusion is supportable, request one specific log, capture, inventory fact, or controlled retest.
Compare your reasoning with the revealed answers if helpful. The block check below is required for course progress.
Required block check · Block 3
Required for course progress · Pass with 2 of 2 correct
Block 4 of 6Control active, passive, and application testing
Practice saved18 min
Control active, passive, and application testing
Practice savedNo provider lesson is assigned to this block. Study the ITForMe lesson below, then take the required check.
Required ITForMe lesson
Control active, passive, and application testing
By the end, you can
- Analyze supplied evidence for passive discovery limit.
- Analyze supplied evidence for assessment stop condition.
Passive discovery observes existing traffic and is less likely to disrupt fragile systems, but it sees only communicating assets and visible protocols. Active probes can confirm reachability and service behavior but add traffic and may trigger unsafe code paths. Choose the least intrusive method that can answer the question.
Web testing needs application ownership, allowed accounts, test-data rules, and explicit limits on destructive actions. An authenticated test can reach role-specific functions; an anonymous test represents a public user. Rate limits and a stop contact are operational controls, not paperwork afterthoughts.
Worked example
A manufacturing segment contains legacy controllers with an outage warning. The team needs an initial asset and protocol inventory.
- Owner constraint: no active probes until vendor review
- SPAN capture: seven controller addresses communicate with one management server
- Inventory: nine expected controllers; two show no traffic during the capture
Passive collection provides evidence for seven assets but cannot prove the two silent controllers are absent.
Report seven observed assets and two unresolved inventory entries; schedule an owner-approved maintenance-window validation for the silent devices.
Reasoning self-check
A manufacturing segment contains legacy controllers with an outage warning. The team needs an initial asset and protocol inventory.
- Owner constraint: no active probes until vendor review
- SPAN capture: seven controller addresses communicate with one management server
- Inventory: nine expected controllers; two show no traffic during the capture
- Record a timestamped fact table from the supplied evidence.
- Test the two most plausible explanations against every observation.
- Choose a bounded defensive action and state the result that would confirm it worked.
Compare your reasoning
Expected answers
- Report seven observed assets and two unresolved inventory entries; schedule an owner-approved maintenance-window validation for the silent devices.
- The conclusion cites at least two supplied observations and names one remaining uncertainty.
If you got stuck
- If the evidence conflicts, preserve both records and check clock, scope, and collection gaps before deciding.
- If no conclusion is supportable, request one specific log, capture, inventory fact, or controlled retest.
Compare your reasoning with the revealed answers if helpful. The block check below is required for course progress.
Work through the scenario
Use the case evidence to complete the tasks, then check objectives.
Guided: Scope an authenticated server scan
A server team needs configuration and missing-patch findings without testing production exploits.
- Vulnerability analystactor
- Authenticated scannercontrol
- Application serversresource
- analystinterpretsevidence
- evidencedescribesasset
Objectives
- Interpret the supplied evidence without overclaimingpending
- Choose the bounded evidence-supported actionpending
- Select evidence that verifies security and operational outcomepending
Evidence 1
Inventory: 24 Linux application servers in 10.40.8.0/27.
Evidence 2
Maintenance window: 02:00-03:00 UTC; service owner approved safe checks.
Evidence 3
Scanner credential: read-only local audit account on the 24 listed assets.
Fictional, disposable SOC evidence. No production system or external service is contacted.
Report an issue with this exercise
Required case practice
Required for the readiness checklist · Pass at 100%
Bound a web application scan
A preproduction API needs dynamic testing while a shared identity service must remain out of scope.
- Application analystactor
- DAST scannercontrol
- Staging APIresource
- analystinterpretsevidence
- evidencedescribesasset
Objectives
- Interpret the supplied evidence without overclaimingpending
- Choose the bounded evidence-supported actionpending
- Select evidence that verifies security and operational outcomepending
Evidence 1
Authorized target: https://api-stage.example.test/v2/.
Evidence 2
Excluded dependency: login.shared.example.test.
Evidence 3
Test account and reset endpoint are supplied; destructive checks are prohibited.
Fictional, disposable SOC evidence. No production system or external service is contacted.
Report an issue with this exercise
Required block check · Block 4
Required for course progress · Pass with 2 of 2 correct
Block 5 of 6Plan scanning from an accountable inventory
Practice saved9 min
Plan scanning from an accountable inventory
Practice savedNo provider lesson is assigned to this block. Study the ITForMe lesson below, then take the required check.
Required ITForMe lesson
Plan scanning from an accountable inventory
By the end, you can
- Explain and apply assessment inventory.
- Explain and apply safe scan plan.
- Explain and apply scan-method selection.
Coverage begins with an accountable population, not a list of responsive addresses. Reconcile cloud IDs, host IDs, interfaces, owners, services, and lifecycle state so duplicates and silent assets remain visible. A scan plan records authorization, time, source, targets, exclusions, credentials, expected load, stop signal, contact, retention, and regulatory limits.
Internal and external vantage points test different exposure. Agents and credentials provide local state but can fail or go stale; agentless and uncredentialed methods observe reachable behavior. Passive collection reduces probe impact but misses silent assets. Combine methods only when each supplies distinct evidence and the authorization permits it.
Worked example
A hospital inventory lists 900 devices; 110 agents are stale, 40 bedside controllers are sensitivity-rated, and an external range contains 12 unknown addresses.
- Maintenance window excludes active controller probes
- Agent dashboard counts stale devices as compliant
- External owner approves discovery but not exploitation
The current denominator and depth are overstated; sensitive controllers and unknown external assets need separate authorized methods.
Report active, stale, sensitive, and unknown populations separately; use passive controller evidence and bounded external discovery under the stated limits.
Reasoning self-check
A factory must assess its internet gateway, internal servers, and safety controllers without disrupting production.
- Inventory: 18 stale agents and 6 unknown addresses
- Gateway: external non-credentialed testing approved
- Controllers: passive now; credentialed active test approved only in maintenance
- Build a short evidence table that separates observations, supported conclusions, and remaining unknowns.
- Choose the authorized action that tests the leading conclusion with the least operational impact.
- Compare your decision and reopen condition with the expected results before continuing.
Compare your reasoning
Expected answers
- Use the full inventory denominator, schedule around operations and regulation, and select separate external/internal, agent/agentless, credentialed, passive, and active methods by target.
- Reopen coverage if stale, silent, duplicate, excluded, or unassessed assets are absent from the denominator.
If you got stuck
- If the answer depends on a product name alone, return to the actual evidence it produced.
- If no option can be falsified, name the missing record before choosing.
Compare your reasoning with the revealed answers if helpful. The block check below is required for course progress.
Required block check · Block 5
Required for course progress · Pass with 3 of 3 correct
Block 6 of 6Use discovery and baselines for different questions
Practice saved8 min
Use discovery and baselines for different questions
Practice savedNo provider lesson is assigned to this block. Study the ITForMe lesson below, then take the required check.
Required ITForMe lesson
Use discovery and baselines for different questions
By the end, you can
- Explain and apply discovery evidence.
- Explain and apply baseline assessment.
Mapping shows what responded from one vantage point; fingerprinting infers a device or service from responses and can be wrong behind proxies, load balancers, or vendor backports. Preserve the target, time, vantage, probes, confidence, and inventory reconciliation. Discovery does not establish patch state or ownership by itself.
PCI DSS requirements apply through the scoped cardholder data environment, including systems that store, process, or transmit account data and systems connected to or able to affect CDE security. CIS Benchmarks give product-specific secure-configuration guidance. The ISO/IEC 27000 family supplies information-security management and control criteria. These are not interchangeable scanner baselines: select each assessment from its actual scope and obligation, record its version/profile, and distinguish not-tested, not-applicable, failed, and verified states.
Worked example
A mapper finds a public TLS endpoint, fingerprints an old web server, and a team marks it PCI compliant because it passes a CIS host profile.
- Load balancer terminates TLS before the application
- Fingerprint confidence: 55%
- Cardholder-data flow has not been mapped
The product inference is weak and a CIS result cannot establish PCI DSS scope or compliance.
Reconcile the endpoint to its owner and backend, map card-data scope, then run the approved versioned baseline and preserve applicability decisions.
Reasoning self-check
A mapping scan finds an authentication server that fronts a payment environment; its banner suggests an old product and it passes a CIS profile.
- Load balancer terminates TLS; fingerprint confidence 48%
- Server stores no account data but can change access to the CDE
- CIS profile passed; ISO/IEC 27001 program exists; PCI scope decision absent
- Build a short evidence table that separates observations, supported conclusions, and remaining unknowns.
- Choose the authorized action that tests the leading conclusion with the least operational impact.
- Compare your decision and reopen condition with the expected results before continuing.
Compare your reasoning
Expected answers
- Record reachability separately from the uncertain fingerprint; assess PCI scope because the server can affect CDE security; retain CIS product-configuration and ISO management/control evidence as distinct assessments.
- Reopen the product conclusion if authenticated inventory disagrees and reopen each baseline decision when CDE connectivity/impact, product profile, or management-system scope changes.
If you got stuck
- If the answer depends on a product name alone, return to the actual evidence it produced.
- If no option can be falsified, name the missing record before choosing.
Compare your reasoning with the revealed answers if helpful. The block check below is required for course progress.
Required block check · Block 6
Required for course progress · Pass with 2 of 2 correct
Review this lesson
Use only this lesson's worked example and key concepts for a quick self-check.
- Restate the worked example in your own words.
- Name the lesson concepts that explain the result.
- Explain why the closest alternative does not fit.
Check the whole objective
This unlocks objective 2.1 for recall. The latest checkpoint needs 70% or higher; a lower result puts the lesson back near the front of your timeline.