Describe how an authorized assessor could combine host discovery, TCP and UDP probing, service information, and saved output to document a network assessment. Explain why the findings do not automatically establish that a host is vulnerable.

### Why this is right The answer distinguishes discovery, transport-specific probing, service identification, and output recording. It also separates evidence of an exposed service from a demonstrated vulnerability, which requires additional authorized validation and context. ### The concept Network enumeration builds an inventory from responses to probes. Host discovery tests whether a system appears responsive; TCP and UDP scans examine different transport services. Version detection and banners can help identify service details, but a banner is not proof that a vulnerable configuration exists. Saved output supports repeatable review. The assessment remains limited by scope, filtering, and the scanner's vantage point. ### What a good answer covers - Confirm authorization and scope before sending probes. - Explain host discovery and the difference between TCP and UDP probing. - Describe service/version information and saving results. - Interpret port states as observations subject to filtering and network conditions. - Distinguish a discovered service from a confirmed vulnerability. ### Terms - **Nmap**: Network Mapper. A tool for discovering hosts and services. - **ICMP**: Internet Control Message Protocol. Carries control messages such as echo requests and unreachable indications. - **TCP**: Transmission Control Protocol. A connection-oriented transport protocol. - **UDP**: User Datagram Protocol. A transport protocol used by network services. - **Banner**: Text or service information returned by a network service, which may help identify it. ### Remember Enumeration identifies observable services; it does not, by itself, prove they are vulnerable.