Examkin

Question

Difficulty: HardVulnerability Scanning and Assessment

A systems administrator deploys a lightweight host-based agent across a fleet of Linux web servers to perform continuous vulnerability assessment. During an audit, the agent flags several critical local kernel vulnerabilities requiring remediation. However, a subsequent uncredentialed network-based vulnerability scan targeting the public IP addresses of these same web servers fails to detect any of the reported kernel flaws. Which of the following best explains why the network vulnerability scan missed these kernel vulnerabilities?

  1. Uncredentialed network scans analyze only network-accessible listening ports and service headers, lacking host-level privileges to inspect internal operating system kernel package manifests.Answer
  2. B
    Network vulnerability scanners apply preventive network firewall rules during probe execution that automatically mitigate kernel flaws upon discovery.
  3. C
    Host-based vulnerability agents require active exploit payloads to confirm kernel flaws, whereas network vulnerability scanners rely exclusively on passive log collection.
  4. D
    Network vulnerability scanners focus exclusively on identifying client-side script execution flaws such as Cross-Site Scripting rather than host operating system vulnerabilities.

Answer

Uncredentialed network scans analyze only network-accessible listening ports and service headers, lacking host-level privileges to inspect internal operating system kernel package manifests.
Uncredentialed network scanners evaluate target hosts from the perspective of an external network observer. They discover open ports, protocols, and service banners. Because operating system kernel vulnerabilities reside inside the host OS and are rarely advertised over network sockets, an uncredentialed network scan cannot audit local package registers or kernel versions. By contrast, a credentialed host agent possesses local system privileges to directly inspect the installed software inventory and kernel build details.

Step-by-Step Solution

1
Analyze the scanning mechanisms described in the scenario.
Identified two scanning approaches: a credentialed/host-agent scan (inside view) and an uncredentialed network scan (outside view).
Different scan types operate with distinct privilege levels and visibility parameters.
2
Determine the visibility constraints of an uncredentialed network scan.
Uncredentialed network scans query open network ports, banners, and remote service protocol interactions without authenticating to the underlying operating system.
Kernel patch levels are internal system state properties that are not typically exposed via external service banners unless a specific exposed service explicitly advertises its host kernel.
3
Evaluate why the host agent successfully detected the flaw while the network scan did not.
The host agent has local administrative access to inspect installed software manifests, system binaries, and running kernel builds directly, enabling detailed vulnerability detection.
Host agents provide deep visibility into local patch state regardless of open network ports or perimeter controls.

Key Concept

Credentialed vs. Uncredentialed Vulnerability Scanning Visiblity
Rate this question

Topics

Vulnerability Scanning and Assessment

More questions from this topic