Examkin

Question

Difficulty: HardVulnerability Scanning and Assessment

A security operations team is updating its vulnerability management strategy across diverse operational environments. Match each vulnerability scanning methodology on the left to the enterprise scenario on the right that best justifies its deployment.

  • Host-based Agent ScanningAuditing local OS patch levels and registry configurations on roaming remote endpoints that rarely connect to the corporate internal network.
  • Passive Network MonitoringIdentifying active assets and unencrypted protocol usage on legacy SCADA networks where active traffic generation risks triggering system failure.
  • Authenticated Network ScanningEvaluating host patch status and network service exposure from an internal subnet using low-privilege service account credentials without installing endpoint software.
  • Intrusive Active ScanningVerifying whether a high-severity flaw in a staging environment can lead to remote code execution, accepting the risk of service degradation.

Answer

Host-based Agent Scanning pairs with auditing roaming remote endpoints; Passive Network Monitoring pairs with identifying assets on sensitive SCADA networks; Authenticated Network Scanning pairs with assessing hosts via service accounts without local agents; Intrusive Active Scanning pairs with verifying exploitability in staging environments despite potential crash risks.
Matching scanning methodologies to enterprise environments requires balancing operational risk, network architecture, credential access, and intrusive potential. Host-based agents cater to remote endpoints; passive monitoring protects sensitive OT/SCADA devices; authenticated network scans gather detailed host data remotely without agents; and intrusive active scans confirm exploitability where downtime is tolerable.

Step-by-Step Solution

1
Analyze the connectivity constraints of remote/roaming devices.
Devices outside the network perimeter require host-installed agents to collect local configuration and patch data independently of network location.
Traditional network scans cannot reliably reach hosts operating outside internal subnets.
2
Evaluate the sensitivity of SCADA and industrial control systems (ICS).
Non-intrusive, passive monitoring via SPAN/TAP ports is required to prevent crash events caused by active network probes.
Legacy embedded systems often fail when receiving non-standard or heavy probe traffic.
3
Assess agentless internal host vulnerability auditing requirements.
Authenticated network scanning leverages valid credentials to query missing patches remotely without host software installation overhead.
Using service account credentials reduces false positives compared to unauthenticated port scans while avoiding endpoint agent deployment.
4
Differentiate non-intrusive vulnerability discovery from intrusive exploit verification.
Intrusive scanning executes payload tests to confirm exploitability (such as RCE), acceptable primarily in non-production or staging environments.
Intrusive methods simulate actual attack vectors and may destabilize target applications.

Key Concept

Selecting Vulnerability Assessment and Scanning Methodologies Based on Operational Risk and Environmental Constraints
Estimated Time:2m 0s
Rate this question

Topics

Vulnerability Scanning and Assessment

More questions from this topic