Examkin

Question

Difficulty: MediumVulnerability Scanning and Assessment

An enterprise security analyst discovers that recent vulnerability scan reports flag several Linux production servers as critical due to missing OS security updates. However, the system administration team provides logs showing that the vendor patches were installed two weeks ago. Further investigation reveals the scanner performed an unauthenticated remote scan relying solely on service banners exposed over open network ports. Which of the following actions should the analyst take to ensure the vulnerability scan accurately reflects the true patch status of the servers?

  1. Configure credentialed scanning parameters to allow the scanner to verify installed packages directly from the local target operating system.Answer
  2. B
    Deploy network-level inline intrusion prevention system rules to drop scanner probe packets targeting exposed service ports.
  3. C
    Update web application firewall filtering rules to strip database error responses and client-side script payloads from server banners.
  4. D
    Reclassify the vulnerability scanner as a compensating security control rather than a detective control in the asset management database.

Answer

Configure credentialed scanning parameters to allow the scanner to verify installed packages directly from the local target operating system.
Unauthenticated vulnerability scans inspect exposed service banners, which frequently causes false positives when backported patches leave version banners unchanged. Configuring credentialed scanning allows the scanner to log into target systems and inspect local package manager records directly, ensuring accurate verification of installed updates.

Step-by-Step Solution

1
Analyze the cause of the reporting mismatch
Unauthenticated network scans rely on banner grabbing, which often reports false positives because patched services may retain their original version banners.
Identifying why the scanner generated inaccurate data is necessary to select the proper technical remediation.
2
Evaluate the capabilities of credentialed scanning
Credentialed scans log directly into the target system to examine local configuration files and package databases.
Authenticating to the host provides accurate data regarding whether patches have been applied.
3
Select the appropriate administrative configuration
Enabling credentialed scanning resolves banner-based false positives without disabling or suppressing scan checks.
This action provides the security team with accurate vulnerability metrics.

Key Concept

Credentialed vs. Unauthenticated Vulnerability Scanning
Rate this question

Topics

Vulnerability Scanning and Assessment

More questions from this topic