A city compares last year's vulnerability assessment to this year's penetration-test scope and wants to skip fresh enumeration because "the VA already listed everything." What should the tester do?
Select an answer to reveal the explanation.
Short Explanation
Old VA notes are a helpful trail map, not a reason to leave the binoculars at home. Networks change—look again, then lean harder where last year already hurt.
Full Explanation
Historical vulnerability assessments inform planning by highlighting recurring weaknesses and high-value assets. They do not freeze the attack surface; configurations, patches, and exposures drift. Fresh enumeration remains required, with prior results used to prioritize—not to skip—recon.