For Teachers · Back to the Module · Print with your browser's Print command.

A1 Worksheet: Running an Assessment

Student Worksheet (about 20 minutes, Applied level)

Name: ______________________ Class: __________ Date: __________

Read first: F2, F3

Learning Objectives

• [ ] Plan a safe assessment of your own machine.
• [ ] Preview every action before scanning.
• [ ] Triage findings by severity and context.

Key Terms

Write each definition in your own words.

• Triage: ______________________________________________
• Dry Run: ______________________________________________
• Evidence: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt scan --dry-run | less
2. Run: openvapt demo --out a1 and triage the top five findings in a short table: finding, real or not, reachable or not, impact.

Self-Check Questions

1. What does openvapt scan --dry-run do?

• [ ] a) Scans faster
• [ ] b) Lists every operation without performing any
• [ ] c) Scans other servers
• [ ] d) Fixes findings automatically

1. Which findings should you look at first?

• [ ] a) Low
• [ ] b) Critical and High
• [ ] c) Passed checks
• [ ] d) Informational

1. During triage, how do you decide whether a finding is real?

• [ ] a) Check the evidence
• [ ] b) Trust the severity alone
• [ ] c) Re-run the scan without reading it
• [ ] d) Assume every finding is real

1. What should you do before scanning a production server?

• [ ] a) Nothing, because the scan is read-only
• [ ] b) Confirm you own or control it, take a backup and prefer a test copy
• [ ] c) Turn off the firewall
• [ ] d) Turn off logging

1. You find a false positive. What should you do?

• [ ] a) Delete it from the report
• [ ] b) Record it honestly as a false positive
• [ ] c) Mark it as fixed
• [ ] d) Raise its severity

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-115, Technical Guide to Information Security Testing and Assessment: https://csrc.nist.gov/pubs/sp/800/115/final

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.