Examkin

Question

Difficulty: HardVulnerability Scanning and Assessment

During a security audit, a vulnerability analyst configures an authenticated network-based vulnerability scanner to audit a subnet of Linux application servers using an SSH service account. The resulting report indicates zero critical or high vulnerabilities across all hosts. However, a concurrent local agent-based scan on the same servers flags several high-severity vulnerabilities associated with missing kernel patches and outdated system libraries. Which of the following best explains why the authenticated network scan failed to detect these vulnerabilities?

  1. The SSH service account lacked root or elevated permissions, preventing the network scanner from querying package managers and inspecting restricted system directories.Answer
  2. B
    Network-based vulnerability scanners rely exclusively on passive traffic monitoring and cannot perform authenticated version verification on active remote hosts.
  3. C
    The network scanner misidentified the missing operating system library dependencies as unexploitable Cross-Site Scripting (XSS) vulnerabilities.
  4. D
    Host-based firewalls on the Linux servers automatically mitigated the internal software vulnerabilities by blocking inbound SSH connection attempts.

Answer

The SSH service account lacked root or elevated permissions, preventing the network scanner from querying package managers and inspecting restricted system directories.
For an authenticated network scan to conduct an accurate patch and vulnerability audit, the scanner must log in using an account with sufficient privileges (such as root or a user with elevated sudo rights). If a low-privileged account is used, the scanner cannot access system package logs, query internal package managers, or inspect restricted system binaries, causing it to miss local software flaws that full-privilege local agents easily detect.

Step-by-Step Solution

1
Analyze the scanning context and discrepancy
An authenticated network scan reported no missing high/critical vulnerabilities, while a local agent identified missing kernel patches and library flaws.
Both scan types examine host configuration, but their depth depends on execution privilege and access context.
2
Evaluate the credential requirements for authenticated network scanning
Network vulnerability scanners connecting via SSH require administrative (root or sudo) privileges to execute local commands, inspect restricted files, and query package managers (e.g., rpm, dpkg).
If the service account used by the scanner lacks sufficient privileges, the scan degrades to basic banner grabbing or limited file checks, failing to discover local software flaws.
3
Compare against local agent privileges
Local security agents typically execute with root/SYSTEM service rights, granting them full visibility into installed software packages regardless of network access accounts.
Insufficient account permissions on remote authenticated scans explain why local agents report vulnerabilities that network scanners miss.

Key Concept

Credentialed vs. Agent-Based Scanning Privileges
Rate this question

Topics

Vulnerability Scanning and Assessment

More questions from this topic