A security operations team is configuring an enterprise vulnerability management program for remote branch office Linux workstations connected over low-bandwidth VPN links. During preliminary network-based scanning, central scanner traffic caused noticeable network congestion across the VPN tunnels, and local host firewalls on workstations dropped multiple probe packets, resulting in incomplete scan results. Which of the following solutions should the team deploy to perform comprehensive vulnerability assessments without saturating WAN bandwidth or altering workstation firewall policies?
- Deploy host-based vulnerability scanning agents on the workstations to collect system metadata locally and transmit compressed audit results to the management console.Answer
- BConfigure an inline network Intrusion Prevention System (IPS) at each branch office to perform active vulnerability scanning of internal workstation traffic.
- CIncrease the central scanner thread count and execute intrusive credentialed network scans using SSH during peak business hours.
- DPlace network-based vulnerability scanners in a DMZ and configure stateless packet filtering rules to bypass workstation host firewalls.
Answer
Deploying host-based vulnerability scanning agents directly on remote workstations enables local patch and configuration auditing without generating high network scan traffic over WAN links.
Deploying host-based scanning agents is the standard solution for environments with constrained network bandwidth or restrictive host firewalls. Agents run locally on the host, audit local software versions and configurations directly, and send small compressed report packages back to the vulnerability management system, avoiding heavy network packet generation across the VPN.
Step-by-Step Solution
Key Concept
Agent-based vs. Network-based Vulnerability Scanning
Estimated Time:1m 30s