Chapter 3 of 5 · CompTIA PenTest+ PT0-003
Vulnerability Discovery and Analysis
Scan types, SAST and DAST, validating results and the main scanning tools.
- 5topics
- 22 minfast track
- 2diagrams and exhibits
- 17%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Vulnerability Scan TypesCompare authenticated and unauthenticated vulnerability scans, agent and network scanning, discovery and compliance scans, and…Diagram4 min
- 2SAST, DAST and Code ScanningCompare static (SAST), dynamic (DAST) and interactive (IAST) application testing with software composition analysis, secrets and…Diagram5 min
- 3Analysing Scan ResultsValidate scanner findings, spot false positives and false negatives, troubleshoot scan settings, and prioritise with CVSS, EPSS…5 min
- 4Vulnerability Discovery ToolsKnow what Nessus, OpenVAS, Nikto, Nuclei, ZAP, Burp Suite, Trivy and cloud scanners are used for, and how to match each tool to a…4 min
- 5Physical Security ConceptsUnderstand physical security concepts the PenTest+ exam names: tailgating, site surveys, USB drops, badge cloning and lock…4 min
About this chapter
What this chapter covers
Vulnerability discovery is the step between knowing what exists and attacking it. The tester finds weaknesses with scanners and code checks, then decides which ones are real and which matter.
The chapter follows the third domain of the CompTIA PenTest+ PT0-003 outline. It covers how scans are set up, what static and dynamic testing find, how to judge the results, and which tools to use.
It has three outline topics, and they are spread across four pages because the scan topic covers both infrastructure and application testing.
How the topics fit together
The pages follow the workflow of a scan from setup to a validated list.
- Scan types decide how deep the scan sees and where it runs from.
- SAST and DAST cover application code and running applications.
- Result analysis removes false positives and ranks what is left.
- Tools such as Nessus, OpenVAS and Nikto do the discovery work.
A scanner finding is only a possibility until it is validated, so exam answers that report raw scanner output without checking it are usually wrong.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
If you have a lab, install one scanner and run both an unauthenticated and an authenticated scan of the same virtual machine. Comparing the two reports teaches the difference faster than reading about it.
Ready for more practice?
The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.