For Teachers · Back to the Module · Print with your browser's Print command.

F2 Teacher Answer Key: What VAPT Is, and Doing It Legally

Teacher Answer Key (about 20 minutes, Foundations level)

Name: ______________________ Class: __________ Date: __________

Read first: F1

Learning Objectives

• [ ] Explain the difference between vulnerability assessment and penetration testing.
• [ ] Describe the phases of NIST SP 800-115 and where OpenVAPT stops.
• [ ] Explain why written authorisation and scope come before any testing.

Key Terms

Write each definition in your own words.

• VAPT: Vulnerability Assessment and Penetration Testing: finding and rating weaknesses, then proving their impact.
• Vulnerability Assessment: Finding and rating known weaknesses without exploiting them.
• Penetration Testing: Authorised testing that tries to exploit weaknesses to demonstrate real impact.
• Scope: The exact systems and activities an assessment is allowed to cover.
• Rules of Engagement: The agreed rules for a security test: what may be tested, when, how and by whom.
• NIST SP 800-115: A NIST guide describing how to plan, perform and report technical security testing and assessment.
• False Positive: A reported problem that is not real.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt scan --dry-run and read every operation it would perform.
2. Find the loopback guard in internal/scope/scope.go and its test. Explain why host names are refused.
3. Write a one-paragraph scope statement for assessing your own test server.

Self-Check Questions

1. What does a penetration test do that a vulnerability assessment does not?

• [ ] a) Rates findings by severity
• [x] b) Attempts to exploit weaknesses to prove impact
• [ ] c) Produces a report
• [ ] d) Looks for known weaknesses
• Answer: b. Both look for weaknesses, rate them and report. Exploitation to demonstrate real impact is the defining activity of a penetration test.

1. Which NIST SP 800-115 phase does OpenVAPT deliberately leave out?

• [ ] a) Discovery
• [ ] b) Reporting
• [x] c) Attack
• [ ] d) Planning
• Answer: c. NIST SP 800-115 names planning, discovery, attack and reporting. OpenVAPT is detection only and never attacks.

1. What must exist before testing a system you do not own?

• [ ] a) A fast internet connection
• [x] b) Written authorisation with a defined scope
• [ ] c) A paid scanner licence
• [ ] d) A tool that is free to use
• Answer: b. Authorisation and scope come first, always. The tool or its price does not give you the right to test.

1. Which scope does OpenVAPT enforce in its code?

• [ ] a) Any host on the local network
• [x] b) Only the machine it runs on
• [ ] c) Any host named on the command line
• [ ] d) Any host covered by written authorisation
• Answer: b. The loopback guard limits OpenVAPT to the machine it runs on and nothing else, even if you have permission for other hosts.

1. Which of these is a methodology for testing web applications?

• [x] a) OWASP Web Security Testing Guide (WSTG)
• [ ] b) CVSS v3.1
• [ ] c) CWE
• [ ] d) Directive 2013/40/EU
• Answer: a. The WSTG is a testing methodology for web applications. CVSS rates severity, CWE classifies weakness types and the directive is European Union law.

1. You run OpenVAPT on a server you rent but do not control. Does its loopback-only scope make the test lawful?

• [ ] a) Yes, local scans are always lawful
• [x] b) No, you still need the right to run it on that machine
• [ ] c) Yes, if the server is in another country
• [ ] d) Only if the scan finishes quickly
• Answer: b. Scope limits what the tool touches. It does not grant permission. You still need the right to run it on that machine, under the law where you and the machine are.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-115, Technical Guide to Information Security Testing and Assessment: https://csrc.nist.gov/pubs/sp/800/115/final
• OWASP Web Security Testing Guide: https://owasp.org/projects/web-security-testing-guide
• Penetration Testing Execution Standard (PTES) Technical Guidelines: https://pentest-standard.readthedocs.io/en/latest/

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.