Examkin

Question

Difficulty: MediumVulnerability Scanning and Assessment

A security analyst conducts a scheduled credentialed vulnerability scan against a cluster of Windows servers. Although the scan completes without generating network connectivity errors, the resulting report indicates zero missing operating system patches, despite known unpatched software being present on the servers. A review of the scanner audit logs shows that initial SMB authentication succeeded, but subsequent administrative probes failed when accessing remote management interfaces. Which of the following best explains why the vulnerability scanner produced incomplete results?

  1. The service account configured for the scan lacked sufficient privileges to query the remote registry and file system.Answer
  2. B
    The perimeter network firewall blocked incoming traffic on port 445, preventing the initial authentication handshake.
  3. C
    The endpoint defense system detected the probe as a cross-site scripting payload and terminated the management connection.
  4. D
    The scanner was operating in passive monitoring mode, which relies on packet sniffing rather than direct host interaction.

Answer

The service account configured for the scan lacked sufficient privileges to query the remote registry and file system.
Credentialed vulnerability scans require administrative-level authorization on target hosts to perform complete file system and registry audits. When a scanner logs in with a standard non-administrative account, the network authentication phase succeeds (e.g., SMB connection on port 445), but subsequent queries to system registries and patch catalogs are denied. This produces incomplete scan results and false negatives regarding missing updates.

Step-by-Step Solution

1
Analyze the scanner log details provided in the scenario.
Identify that SMB authentication succeeded, but detailed system probing failed.
Successful SMB authentication indicates that network ports are open and basic account credentials are valid.
2
Evaluate permission requirements for credentialed host audits.
Recognize that inspecting Windows patch levels requires local administrative privileges (such as access to Remote Registry and WMI).
Standard non-administrative accounts are restricted from reading sensitive system hives and patch registries, causing false negative results.
3
Identify the primary root cause matching the scan behavior.
Determine that insufficient account privileges prevented complete vulnerability assessment.
Granting proper administrative rights to the scan service account resolves authorization bottlenecks during deep host probing.

Key Concept

Credentialed Vulnerability Scanning Authorization Requirements
Rate this question

Topics

Vulnerability Scanning and Assessment

More questions from this topic