A security engineer is planning a vulnerability assessment for an enterprise network segment containing legacy operational technology (OT) devices. These endpoints are highly sensitive to network traffic volume and frequently crash when subjected to active service probing or rapid port sweeps. The engineer must obtain a detailed inventory of missing security patches and system misconfigurations without causing service outages or operational downtime. Which of the following approaches should the engineer implement?
- Deploy host-based scanning agents on the target endpoints to gather internal patch and configuration data locally.Answer
- BImplement an inline intrusion prevention system to perform automated vulnerability detection on transit network traffic.
- CConfigure web application firewall rules to inspect and sanitize incoming database payloads on the target segment.
- DSchedule an unauthenticated network vulnerability scan using maximum packet rate intensity during off-peak hours.
Answer
Deploying host-based scanning agents on the target endpoints to gather internal patch and configuration data locally.
Host-based vulnerability scanning agents run directly on the target operating system to inventory missing security patches, software versions, and local misconfigurations internally. Because agents gather data via local system calls rather than sending network probes across the wire, they eliminate the risk of network traffic spikes or port scan probes crashing fragile legacy OT systems.
Step-by-Step Solution
Key Concept
Agent-Based vs. Network-Based Vulnerability Scanning
Estimated Time:1m 30s