Examkin

Question

Difficulty: EasyVulnerability Scanning and Assessment

A security administrator must evaluate an operational technology (OT) network supporting critical infrastructure. The administrator needs to identify missing operating system patches and open ports without running tests that could potentially disrupt operations or crash sensitive services. Which type of vulnerability scan should the administrator perform?

  1. A non-intrusive scanAnswer
  2. B
    An intrusive scan
  3. C
    A web application SQL injection exploitation test
  4. D
    A detective control audit

Answer

A non-intrusive scan should be performed because it detects potential vulnerabilities without executing active exploit payloads or sending aggressive network traffic that could interrupt sensitive services.
Non-intrusive scanning identifies potential security weaknesses by checking host responses and software versions against known vulnerability signatures without executing invasive tests that could cause system failure.

Step-by-Step Solution

1
Analyze the scenario requirements and operational constraints
The target environment contains sensitive operational technology devices where service downtime must be avoided.
Critical infrastructure systems are often sensitive to aggressive network probes and active exploitation tests.
2
Evaluate scanning methodologies against safety criteria
Select a non-intrusive scan.
Non-intrusive scans gather version information and inspect configuration parameters safely without risking system instability.

Key Concept

Non-intrusive vs. Intrusive Vulnerability Scanning
Rate this question

Topics

Vulnerability Scanning and Assessment

More questions from this topic