Examkin

Question

Difficulty: HardVulnerability Scanning and Assessment

A security engineer is optimizing the vulnerability assessment program for a enterprise high-frequency transaction cluster located behind inline firewalls and web application firewalls (WAFs). Non-credentialed network scans previously returned zero high-severity findings, but network traffic analysis revealed several outdated service daemons running on internal nodes. The engineer must obtain accurate, detailed patch level and configuration data across all hosts while preventing latency spikes, network congestion, and false-positive results caused by network security controls. Which of the following assessment strategies should the engineer implement to meet these requirements?

  1. Deploy local agent-based vulnerability scanners on each cluster host to execute authenticated system checks directly on the endpoints.Answer
  2. B
    Configure aggressive network-based credentialed scans via SSH and WMI traversing the inline WAF during peak traffic hours.
  3. C
    Temporarily disable inline firewall rules and execute intrusive exploitation scripts to confirm remote shell access vulnerabilities.
  4. D
    Run automated web application security scanners targeting client-side Cross-Site Scripting (XSS) payloads against backend database daemons.

Answer

Deploy local agent-based vulnerability scanners on each cluster host to execute authenticated system checks directly on the endpoints.
Deploying agent-based vulnerability scanners is the most effective approach for high-availability, low-latency production environments. Agents execute authenticated audits directly on the host operating system, providing complete visibility into missing security patches, registry settings, and local software inventories without generating network traffic spikes or being impacted by inline network firewalls and WAFs.

Step-by-Step Solution

1
Analyze the operational constraints and requirements of the environment.
Identified high-frequency transaction cluster requiring zero latency impact, minimal network overhead, and immunity to network security control interference (firewalls/WAFs).
Network-based scanning can be blocked, throttled, or distorted by inline network security controls and can introduce latency.
2
Compare credentialed scanning methods (network-based credentialed vs. agent-based).
Agent-based scanners execute locally on host OS resources, leveraging local administrative context without generating heavy network scan traffic.
Local agents provide deep visibility into patch levels and local configurations while bypassing network security boundaries safely.
3
Select the optimal vulnerability scanning architecture.
Agent-based scanning satisfies all requirements by ensuring accurate vulnerability identification without network performance degradation.
It addresses both the failure of non-credentialed scans and the performance/firewall constraints of network-based scanning.

Key Concept

Agent-Based vs. Network-Based Credentialed Vulnerability Scanning
Estimated Time:2m 0s
Rate this question

Topics

Vulnerability Scanning and Assessment

More questions from this topic