Which of the following types of scans is often performed in conjunction with vulnerability scanning?

The type of scan that is often performed in conjunction with vulnerability scanning is penetration testing. Vulnerability scanning is a process that identifies vulnerabilities in systems, applications, and network configurations but does not exploit them. Penetration testing takes this a step further by simulating real-world attacks to exploit those vulnerabilities and assess the actual risk they pose to the organization.

By combining vulnerability scanning with penetration testing, organizations can first discover potential weaknesses and then verify whether these vulnerabilities can be exploited, providing a deeper context for how secure their systems are. This dual approach helps prioritize which vulnerabilities to address based on the potential impact they could have if exploited.

The other options, while related to security practices, do not directly complement vulnerability scanning in the same way. Compliance auditing focuses on verifying adherence to laws, regulations, and standards, which is distinct from identifying and exploiting technical vulnerabilities. Data recovery is concerned with recovering lost data rather than assessing vulnerabilities. Network mapping, while useful for understanding network layout and connections, does not involve the assessment of vulnerabilities or their exploitation. Therefore, penetration testing is uniquely suited to augment vulnerability scanning by verifying the presence and depth of exploitation possibilities for the vulnerabilities identified.