Examkin

Question

Difficulty: HardVulnerability Scanning and Assessment

A security engineer is refining the vulnerability assessment strategy for an enterprise data center hosting high-availability web applications and legacy backend databases. To ensure deep asset visibility while mitigating the risk of service disruption and unauthorized network impact, which of the following operational practices should the engineer implement? (Select TWO.)

  1. Schedule intrusive vulnerability scanning templates exclusively during pre-approved maintenance windows.Answer
  2. Use credentialed access to audit local system configurations, installed software inventories, and missing patches.Answer
  3. C
    Deploy network perimeter firewalls to automatically repair application-layer vulnerabilities identified by the scanner.
  4. D
    Classify the automated vulnerability scanner as a corrective control designed to remediate security weaknesses automatically.

Answer

The security engineer should schedule intrusive vulnerability scan templates exclusively during pre-approved maintenance windows and use credentialed access to audit local configurations, installed software, and missing patches.
Scheduling intrusive scans during maintenance windows protects production availability from unexpected system crashes, while credentialed scanning provides precise internal configuration visibility with minimal network impact and reduced false positives.

Step-by-Step Solution

1
Evaluate the operational impact of scan intensity levels on critical assets.
Recognize that intrusive scanning techniques can exhaust host resources or crash legacy services if executed during peak hours.
Intrusive scans actively probe weaknesses and must be confined to maintenance windows to safeguard service availability.
2
Determine the scanning methodology that maximizes accuracy while reducing network overhead.
Select authenticated (credentialed) scanning over unauthenticated network probing.
Credentialed scanning queries local system registries and patch databases directly, reducing false positives without saturating network bandwidth.
3
Differentiate detective scanning tools from preventive and corrective security controls.
Reject firewalls and scanners as automated patch remediation mechanisms.
Scanners are detective controls and firewalls are preventive traffic filters; application flaws require software updates or code refactoring.

Key Concept

Vulnerability Scanning Methodologies and Operational Controls
Rate this question

Topics

Vulnerability Scanning and Assessment

More questions from this topic