CoreQ Academy3.2 Given a scenario, analyze output from reconnaissance, scanning, and enumeration phases.
Scanner output is evidence, not truth. Validate it before reporting or exploiting.
Validate scan, reconnaissance, and enumeration results
- False positives
- Reported issues that are not real; waste client time if reported.
- False negatives
- Real issues the tool missed; reduce with authenticated scans and manual testing.
- True positives
- Confirmed real findings.
- Scan completeness
- Checking that all in-scope targets and ports were actually covered.
- Troubleshooting scan configurations
- Fixing timeouts, rate limits, credential failures or blocked probes that skew results.
Next steps
- Public exploit selection
- Choosing a well-understood public exploit that matches the confirmed version, reviewing its code first and testing safely.
- Use scripting to validate results
- Writing quick scripts to confirm findings at scale, such as checking a header on 200 hosts.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 3.2 of the publicly available CompTIA PenTest+ PT0-003 exam objectives (Exam objectives V3, document version 5.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.