Examkin

Question

Difficulty: MediumVulnerability Scanning and Assessment

An enterprise security team deploys an automated vulnerability scanner to conduct network-based discovery across a newly created subnet housing microservices. Although monitoring tools verify that the microservices are online and actively serving traffic, the scanner's report indicates zero active hosts were discovered on the target subnet. Which of the following best explains why the vulnerability scanner failed to identify the active hosts?

  1. Network security controls or host firewalls on the target subnet are blocking the initial ICMP echo requests and TCP/UDP discovery probes.Answer
  2. B
    The scanner was configured with a non-credentialed account, preventing it from binding to container runtime APIs during the discovery phase.
  3. C
    An inline Web Application Firewall (WAF) compensated for network vulnerabilities by encrypting internal container-to-container communication.
  4. D
    The vulnerability scanner automatically suppresses discovery alerts whenever targeted systems use dynamic IP address allocations.

Answer

The vulnerability scanner failed to identify active hosts because network security controls or host firewalls on the target subnet dropped the ICMP echo requests and initial TCP/UDP discovery probes used during host identification.
Vulnerability scanners initiate assessments with a host discovery phase using ICMP echo requests and TCP/UDP probes to identify active targets. When firewalls or network access control lists (ACLs) silently drop these discovery packets, the scanner concludes that no hosts are live at those IP addresses, resulting in a scan report showing zero active systems despite services running.

Step-by-Step Solution

1
Analyze the scanning phase described in the scenario.
The scanner failed during the initial host discovery phase before vulnerability identification took place.
Vulnerability scanners first send lightweight network probes (ICMP, ARP, or standard TCP SYN packets to common ports) to determine if target IP addresses are alive.
2
Evaluate how firewalls impact network discovery probes.
Firewalls configured to drop ICMP packets and unsolicited port requests cause the scanner to register the hosts as unreachable or inactive.
When discovery probes receive no response or are silently dropped, the scanner assumes no host is bound to that IP address and skips further vulnerability assessment on those targets.

Key Concept

Host Discovery Suppressions and Firewall Interferences in Vulnerability Scanning
Rate this question

Topics

Vulnerability Scanning and Assessment

More questions from this topic