Which statement best describes the role of vulnerability scanners in a penetration test?

• A. They identify weaknesses in systems and generate prioritized remediation reports
• B. They automatically fix vulnerabilities
• C. They provide real-time incident response
• D. They only test password strength

Answer: (A)

Vulnerability scanners in a penetration test are used to systematically identify weaknesses in systems and generate prioritized remediation reports. They automatically scan assets, services, and configurations against known vulnerability databases to surface missing patches, misconfigurations, and exposure points. The real value lies in producing risk-based findings with severity levels, affected assets, and practical mitigation steps, which guides both the tester’s manual validation and the organization’s remediation efforts. They don’t automatically fix issues, and incident response is not their function; password strength testing is just a small part of what such tools can assess.