Examkin

Question

Difficulty: HardVulnerability Scanning and Assessment

A security analyst conducts both a credentialed host vulnerability assessment and a non-credentialed network scan against a critical Linux database server. The non-credentialed network scan reports zero critical vulnerabilities, whereas the credentialed scan identifies multiple unpatched kernel vulnerabilities and weak local file permissions. Additionally, internal host firewalls on the server are configured to drop ICMP and block unauthenticated port probing from outside the local management subnet. Which of the following best explains the discrepancy between the two scan results?

  1. The host firewall filtered the non-credentialed scanner's network probes, and non-credentialed scans lack the local OS permissions required to audit internal patch levels and configuration files.Answer
  2. B
    The credentialed scan executed active exploit payloads to verify vulnerability exploitability, whereas non-credentialed scans are restricted to passive network traffic monitoring.
  3. C
    Non-credentialed vulnerability scanners evaluate target systems exclusively via static source code analysis (SAST) rather than probing running network services.
  4. D
    The non-credentialed scanner mistakenly identified Cross-Site Scripting (XSS) vulnerabilities on the host as database SQL injection false positives.

Answer

The host firewall filtered the non-credentialed scanner's network probes, and non-credentialed scans lack the local OS permissions required to audit internal patch levels and configuration files.
The option explaining that the host firewall filtered network probes while non-credentialed scans lack local OS permissions is correct. Credentialed scans log into the operating system using valid account privileges to audit internal configurations, installed packages, kernel versions, and local user rights. Non-credentialed scans view the target solely from the network perspective; if network traffic is blocked by firewalls or ACLs, or if vulnerabilities are internal to the OS configuration, non-credentialed scans will produce false negatives.

Step-by-Step Solution

1
Analyze the operational difference between credentialed and non-credentialed vulnerability scans.
Credentialed scans authenticate to the host OS using administrative credentials to inspect local files, registries, and patch status. Non-credentialed scans only examine network-exposed ports, banners, and services.
Understanding scan context determines what visibility each scanner type possesses.
2
Evaluate the impact of the target server's host firewall configuration.
The host firewall drops unauthenticated probes, causing the non-credentialed network scanner to see closed/filtered ports and miss running services.
Network filtering prevents non-credentialed scanners from reaching listening services or gathering banner information.
3
Synthesize why the credentialed scan successfully uncovered unpatched kernel flaws and weak permissions.
Because the credentialed scan authenticated locally, it bypassed network firewall restrictions and directly queried local system state (kernel version, patch history, and file system permissions).
Local system access provides complete visibility regardless of perimeter network controls.

Key Concept

Credentialed vs. Non-Credentialed Vulnerability Scanning
Estimated Time:2m 0s
Rate this question

Topics

Vulnerability Scanning and Assessment

More questions from this topic