Question

Difficulty: EasyVulnerability Scanning and Assessment

Match each vulnerability scanning concept on the left with its corresponding operational description on the right.

  • Credentialed ScanUses administrative log-in privileges to perform deep host-level inspection of patches and settings.
  • Non-Credentialed ScanProbes targets without system log-in credentials to identify externally exposed services.
  • Passive ScanObserves and analyzes existing network traffic without sending probes to target systems.
  • Intrusive ScanExecutes active verification scripts that risk causing system instability or service disruption.

Answer

Credentialed Scan pairs with using administrative privileges for internal inspection; Non-Credentialed Scan pairs with probing target services without log-in credentials; Passive Scan pairs with observing network traffic without sending probes; Intrusive Scan pairs with executing active verification scripts that risk disrupting system stability.
Each scanning technique directly aligns with its specific operational characteristic: credentialed scans log in locally, non-credentialed scans probe externally without authentication, passive scans sniff network traffic without transmitting packets, and intrusive scans run verification checks that may disrupt target services.

Step-by-Step Solution

1
Evaluate authentication requirements for scanning modes.
Credentialed scanning requires valid system credentials for internal host access, whereas non-credentialed scanning operates without log-in access.
Privilege access determines whether the scanner inspects internal settings or external interfaces.
2
Evaluate traffic generation and system impact levels.
Passive scanning silently inspects passing network traffic without sending packets, while intrusive scanning sends active probes that can disrupt target services.
Operational safety dictates whether silent packet capture or active impact testing is appropriate.

Key Concept

Vulnerability assessment tools vary by privilege level (credentialed vs. non-credentialed) and network impact (passive vs. intrusive).
Rate this question