8.1 Network, Host, Authenticated, and Wireless Scans

Domain 3, Vulnerability Discovery and Analysis, is 17 percent of CompTIA PenTest+ PT0-003. Objective 3.1 — Given a scenario, conduct vulnerability discovery using various techniques — is a matching skill: pick the scan type that fits the asset, the authorization, and the vantage point. Discovery is not exploitation. In the Penetration Testing Execution Standard (PTES), this work still sits in vulnerability analysis. You are building an evidence-backed list of weaknesses. You are not firing an exploit, dumping the Security Account Manager, or proving ransomware. Exam stems that jump from a banner CVE to a working payload are testing Domain 4, not 3.1.

The first cluster of 3.1 types is the classic perimeter-and-host set: network scans (TCP, UDP, and stealth), host-based scans, authenticated versus unauthenticated scans, and wireless scans (SSID, channel, and signal strength).

Network scans: TCP, UDP, and stealth

A network scan probes live addresses from the tester's vantage — a laptop, jump box, or cloud scanner that can route to the in-scope Classless Inter-Domain Routing (CIDR) block. It answers which ports respond and which remote services look vulnerable from that path.

TCP scanning uses Transmission Control Protocol. A full-connect scan completes the three-way handshake (SYN, SYN-ACK, ACK) and then usually tears the session down. The operating system can log a real connection. A stealth scan in CompTIA's 3.1 sense is the half-open SYN pattern: send SYN, record SYN-ACK (open) or RST (closed), and do not send the final ACK. You learned that a port would accept a connection without becoming a fully established session. Modern firewalls and intrusion-detection systems still see those SYNs. "Stealth" is not invisibility. It is a quieter TCP technique than a completed connect, and it is still active.

UDP scanning uses User Datagram Protocol. There is no handshake. An ICMP Port Unreachable often means closed. Silence can mean open, filtered, or rate-limited — which is why UDP is slower and more ambiguous than TCP. You still need UDP when the asset is Domain Name System (UDP 53), Simple Network Management Protocol (UDP 161), Internet Key Exchange (UDP 500), or an industrial or voice listener that never speaks TCP.

Exam trap: treating stealth as passive reconnaissance. A SYN still lands on the host. Objective 2.1 passive recon does not send that packet. Another trap: memorizing twenty Nmap flags. PT0-003 3.1 wants the concept — full TCP connect versus stealth SYN versus UDP — and the decision of when each is appropriate, not a cheat sheet of scanner syntax.

Network scans see what the path exposes. Banners, TLS certificates, and service fingerprints produce remote CVE matches. They do not magically see a missing Windows knowledge base (KB) article or a service bound only to 127.0.0.1.

Host-based scans

A host-based scan runs on the endpoint: an agent, a local scanner package, or a collection job that queries the operating system as if you were logged on. It inventories installed software, patch level, local listeners, registry or configuration keys, and missing security updates that no banner will ever mention.

Host-based is the answer when the stem says the tester has a laptop image, a golden machine image, or an approved agent on the server, and the goal is local weakness rather than a path from 10.0.0.0/24. It is not the same as a network TCP scan of that host, and it is not the same as static review of source code.

Authenticated versus unauthenticated

Unauthenticated scans use no credentials. They show the outsider view: open ports, banners, default pages, and CVEs that can be inferred without logging in. Authenticated scans use approved credentials — Windows domain or local accounts, SSH keys, SNMP community strings, database logins, or API tokens — so the scanner can read patch databases, local services, file permissions, and missing hotfixes.

In the field, a credentialed Tenable Nessus scan of a Windows host is both "using the network" and "seeing host state." The exam still treats the bullets as distinct. Host-based names the vantage (on the box). Authenticated versus unauthenticated names whether you had credentials. You can run an unauthenticated network scan, an authenticated network scan, and a host-based agent scan against the same IP and get three different inventories.

Worked example: 10.0.0.0/24 and host 10.0.0.14

The statement of work names 10.0.0.0/24. An unauthenticated Tenable Nessus scan of the subnet finds 10.0.0.14 with Apache listening on TCP 80 and a banner-matched CVE for the advertised 2.4.x string. That is a valid outsider finding. It is also incomplete. The same host, scanned again with a domain account, reports a missing Windows security KB and a local service running as SYSTEM that never appeared in the banner. Credentials changed the vantage, not the IP.

Exam trap: calling the authenticated scan "stealth" because it used a valid login, or calling the unauthenticated scan "passive" because it did not log in. Login state is authenticated versus unauthenticated. Packet completeness is stealth versus full connect. Those axes are independent. You can run a stealth SYN scan with no credentials, and you can run a noisy full-connect authenticated scan.

Wireless scans on 3.1: SSID, channel, signal strength

Wireless on objective 3.1 is a scan type, not the Domain 4 attack playbook. CompTIA names three techniques.

SSID scanning lists service set identifiers that are advertised (and, with more work, names that leak in client probe requests). Channel scanning records which channel and band an access point uses — 2.4 GHz versus 5 GHz versus 6 GHz, and the channel number that matters for overlap and for later authorized testing. Signal-strength scanning records received signal strength (RSSI or a similar reading) so you can tell which AP is actually in the engagement space, which is a neighbor, and where a tester would need to stand to stay in-scope.

This is adjacent to objective 2.2 wireless enumeration (SSID, hidden networks, clients, WPA2 versus WPA3), but 3.1 is asking you to treat wireless as vulnerability-discovery instrumentation: scan the air for identifiers, channels, and power, then decide whether an in-scope AP is weak, mis-sited, or outside the agreed RF window. Deauthentication, evil twins, and handshake cracking are objective 4.7. Hearing a neighbor guest network in the parking lot does not put it in the /24.

Keep the worked example honest. The Nessus pass on 10.0.0.0/24 did not assess the office SSID. If rules of engagement include wireless, add an SSID, channel, and signal-strength pass; do not assume the wired scan covered the air.

Sequence on the exam: pick the vantage (network path, host agent, credentials, or RF), pick TCP versus UDP versus stealth only when the stem is about packets, and do not call discovery an exploit.