3.1. Vulnerability Scanning Methods and Concepts

💡 First Principle: The right scanning approach for a given environment balances thoroughness (finding all vulnerabilities) against operational risk (scanning itself can disrupt sensitive systems) — which means no single scanning approach works everywhere.

Scanning a production database server with an aggressive active scan during business hours can cause performance degradation or crashes. Scanning an OT environment the same way you'd scan a corporate laptop network can take industrial equipment offline. Understanding the trade-offs between scan types isn't just academic — it's the basis for the "special considerations" the exam tests explicitly.

⚠️ Common Misconception: More aggressive scanning always finds more vulnerabilities. In reality, credentialed scans find the most — software vulnerabilities and local misconfigurations — while passive scans observe hosts, services, and protocols from network traffic with zero operational risk. The right scan type depends on the target system's sensitivity, the regulatory environment, and what questions you're trying to answer.