Examkin

Question

Difficulty: MediumVulnerability Scanning and Assessment

An enterprise security team is selecting appropriate vulnerability assessment methodologies for distinct operational requirements across the enterprise environment. Match each vulnerability assessment approach on the left with the operational use case on the right that best represents its application.

  • Credentialed Vulnerability ScanningAuthenticates directly to target operating systems via management interfaces (such as SSH or WinRM) to inspect internal registry keys and installed software packages with low false-positive rates.
  • Non-Credentialed Vulnerability ScanningProbes externally accessible IP addresses over the network without system privileges, primarily identifying open network ports, weak service banners, and external attack surfaces.
  • Passive Vulnerability MonitoringInspects mirrored network traffic via SPAN ports to identify vulnerable protocols and active hosts without transmitting active probe packets into sensitive operational segments.
  • Agent-Based Vulnerability AssessmentExecutes natively on remote endpoints to collect internal security configuration data continuously, even when devices are disconnected from the enterprise network.

Answer

Credentialed Scanning matches authenticated administrative system inspection; Non-Credentialed Scanning matches unauthenticated network service discovery; Passive Monitoring matches non-intrusive SPAN port traffic analysis; Agent-Based Assessment matches continuous endpoint monitoring independent of network location.
Each vulnerability assessment method fulfills a specific operational requirement based on access privileges, network placement, and traffic tolerance. Credentialed scanning provides in-depth host visibility through authentication; non-credentialed scanning measures unauthenticated perimeter exposure; passive monitoring provides zero-impact traffic observation via SPAN/TAP; and agent-based scanning provides continuous host inspection for off-network endpoints.

Step-by-Step Solution

1
Analyze the access perspective of Credentialed vs. Non-Credentialed scanning.
Credentialed scanning accesses internal OS parameters via login credentials to reduce false positives, matching right_1. Non-credentialed scanning examines exposed network ports without credentials, matching right_2.
Authenticating directly allows scanners to query internal package managers and registries directly, whereas unauthenticated scans only see externally exposed services.
2
Evaluate the traffic impact of Passive Vulnerability Monitoring.
Passive monitoring observes mirrored traffic (SPAN/TAP) without generating probe traffic, matching right_3.
Sensitive industrial control systems or operational technology environments require zero active probe traffic to prevent service disruption.
3
Examine the operational scope of Agent-Based Vulnerability Assessment.
Local agents collect local system data continuously and report back when connected, matching right_4.
Mobile or remote laptops frequently move off-premise, making active network scans ineffective compared to host-installed software agents.

Key Concept

Vulnerability Scanning Methodologies and Operational Scenarios
Rate this question

Topics

Vulnerability Scanning and Assessment

More questions from this topic