Assignment – 03
Network Vulnerability Scanners
1. Compare and contrast two widely used network vulnerability scanners (e.g., Nessus and OpenVAS). What are their
unique features, and in what scenarios would you recommend each?
2. Conduct a vulnerability scan on a virtualized network setup (e.g., using VirtualBox or VMware). Document the
steps and analyze the results of the scan. Identify any discovered vulnerabilities and propose mitigation strategies.
3. Research and write a report on the ethical and legal considerations of using network vulnerability scanners in a
corporate environment. What permissions are required before conducting scans?
4. Identify the limitations of network vulnerability scanners in detecting modern cyber threats. Suggest
complementary tools or approaches to mitigate these limitations.
Agent-Based and Agentless Scanners
5. Define and differentiate agent-based and agentless scanners. Provide examples of tools that use each approach and
discuss their advantages and disadvantages in different use cases.
6. Set up an agent-based scanner and an agentless scanner in a test environment. Compare their effectiveness in
detecting vulnerabilities and evaluate their impact on network performance and resource usage.
7. Research and analyze the scalability challenges of agent-based and agentless scanners. Which approach would you
recommend for a large enterprise network and why?
Application Scanners (DAST, SAST, RASP)
8. Compare Dynamic Application Security Testing (DAST), Static Application Security Testing (SAST), and Runtime
Application Self-Protection (RASP) in terms of their methodologies, strengths, and limitations. Illustrate your findings
with examples of tools or case studies.
9. Perform a basic SAST and DAST scan on a sample web application (e.g., an open-source project). Identify any
vulnerabilities reported and discuss how these could be resolved.
10. Research how Runtime Application Self-Protection (RASP) works in modern application security. Create a small
presentation or demonstration to explain its real-time defense capabilities.
