Examkin

Question

Difficulty: Very hardVulnerability Scanning and Assessment

A security engineer is conducting vulnerability scans across an enterprise hybrid cloud environment. During network-based authenticated scans of Linux server instances, the scanner continuously reports multiple critical vulnerabilities for outdated software packages. However, system administrators confirm that vendor-specific security patches were already installed via package management backporting, which updates internal code without changing upstream major version strings. Furthermore, the network scans consistently fail to capture vulnerabilities on ephemeral, short-lived container instances deployed during peak auto-scaling events. Which of the following vulnerability assessment approaches should the security engineer implement to eliminate these false positives and ensure continuous visibility into short-lived instances?

  1. Deploy agent-based vulnerability scanning software directly onto the host images.Answer
  2. B
    Switch the vulnerability assessment profile from authenticated to non-credentialed network probing.
  3. C
    Configure an inline web application firewall to suppress alert signatures targeting the outdated version headers.
  4. D
    Modify SIEM log correlation rules to flag and filter out version banner discrepancies from firewall logs.

Answer

Deploying agent-based vulnerability scanning software directly onto host images.
Deploying local scanning agents on host images ensures direct access to system package databases (such as RPM or DPKG), allowing the scanner to verify backported security fixes accurately without relying on misleading network version banners. Agents also initialize automatically when auto-scaled or ephemeral containers boot up, guaranteeing visibility during short lifespans.

Step-by-Step Solution

1
Analyze the core limitations of the current network-based vulnerability scanning methodology.
Network-based scanners often rely on version banners retrieved via remote services, leading to false positives when enterprise Linux distributions backport security fixes without changing version numbers. Network scans also miss ephemeral hosts that terminate before scheduled scan windows.
Identifying why false positives occur and why short-lived assets are missed is necessary to select the proper scanning architecture.
2
Evaluate how agent-based scanning addresses local software inventory and ephemeral infrastructure.
Local agents query local package management databases directly, recognizing backported fixes accurately. Additionally, agents register immediately upon instance launch, providing instant visibility into short-lived workloads.
Agent-based deployment solves both the backporting false-positive issue and the ephemeral asset tracking challenge.

Key Concept

Agent-based vs. Network-based Vulnerability Scanning
Estimated Time:2m 0s
Rate this question

Topics

Vulnerability Scanning and Assessment

More questions from this topic