What is the difference between vulnerability scanning and configuration assessment?

What is the difference between vulnerability scanning and configuration assessment?

• A. Scanning identifies vulnerabilities; configuration assessment checks if systems comply with secure baselines.
• B. Scanning verifies compliance with baselines; configuration assessment detects new flaws.
• C. Scanning inventories assets; configuration assessment monitors user access.
• D. Scanning is only for networks; configuration assessment applies to databases.

Answer: (A)

The difference being tested is what each activity aims to achieve: vulnerability scanning looks for weaknesses that could be exploited, while configuration assessment checks whether the system’s settings align with a secure baseline or policy. Vulnerability scanningAutomates checks against known weaknesses, missing patches, misconfigurations that could be exploited, and other flaws that threat actors could leverage. It results in a list of vulnerabilities with severities to guide remediation, focusing on what could go wrong if an attacker targets the system. Configuration assessment, by contrast, compares how a system is configured to a predefined secure baseline (like CIS benchmarks or internal security standards). It verifies that settings such as password policies, account lockout, auditing, and file permissions meet the required controls, and it flags deviations to be remediated so the system stays in a compliant, hardened state. Together, they cover different angles: find and fix vulnerabilities to reduce exploitable weaknesses, and ensure configurations meet established security baselines to limit potential attack surface. The other descriptions mix these roles, or misstate which activity targets baselines, new flaws, assets, or specific asset types.

The difference being tested is what each activity aims to achieve: vulnerability scanning looks for weaknesses that could be exploited, while configuration assessment checks whether the system’s settings align with a secure baseline or policy.

Vulnerability scanningAutomates checks against known weaknesses, missing patches, misconfigurations that could be exploited, and other flaws that threat actors could leverage. It results in a list of vulnerabilities with severities to guide remediation, focusing on what could go wrong if an attacker targets the system.

Configuration assessment, by contrast, compares how a system is configured to a predefined secure baseline (like CIS benchmarks or internal security standards). It verifies that settings such as password policies, account lockout, auditing, and file permissions meet the required controls, and it flags deviations to be remediated so the system stays in a compliant, hardened state.

Together, they cover different angles: find and fix vulnerabilities to reduce exploitable weaknesses, and ensure configurations meet established security baselines to limit potential attack surface. The other descriptions mix these roles, or misstate which activity targets baselines, new flaws, assets, or specific asset types.