Which assessment type observes vulnerabilities through the Internet using external routers, firewalls, or web servers?

Which assessment type observes vulnerabilities through the Internet using external routers, firewalls, or web servers?

• A. Internal vulnerability assessment
• B. External vulnerability assessment
• C. Penetration testing
• D. Compliance audit

Answer: (B)

Assessing vulnerabilities from the Internet means looking at what a system exposes to the outside world and how an attacker might reach it. This approach checks externally visible surfaces such as public web servers, and perimeter devices like routers and firewalls, using scanners and tests from an outside vantage point. The goal is to identify weaknesses that could be exploited by an attacker without inside access—things like exposed services, open ports, weak configurations, or missing patches on internet-facing systems. This external perspective helps prioritize remediation to reduce what could be exploited from outside the network. This differs from an internal vulnerability assessment, which models threats from within the network after access has been gained, and from penetration testing, which actively attempts to exploit discovered vulnerabilities to demonstrate real impact. A compliance audit, by contrast, focuses on regulatory and policy adherence rather than uncovering exposed or misconfigured systems.

Assessing vulnerabilities from the Internet means looking at what a system exposes to the outside world and how an attacker might reach it. This approach checks externally visible surfaces such as public web servers, and perimeter devices like routers and firewalls, using scanners and tests from an outside vantage point. The goal is to identify weaknesses that could be exploited by an attacker without inside access—things like exposed services, open ports, weak configurations, or missing patches on internet-facing systems. This external perspective helps prioritize remediation to reduce what could be exploited from outside the network.

This differs from an internal vulnerability assessment, which models threats from within the network after access has been gained, and from penetration testing, which actively attempts to exploit discovered vulnerabilities to demonstrate real impact. A compliance audit, by contrast, focuses on regulatory and policy adherence rather than uncovering exposed or misconfigured systems.