SY0-701 Question 69
Single answerVulnerable software: Client-based vs. agentlessA security administrator is choosing a vulnerability assessment approach for a mixed environment that includes on-premises workstations, laptops that frequently leave the office, and several servers in a restricted network segment. The administrator wants the most accurate visibility into missing patches and insecure software configurations on the laptops even when they are off the corporate network. However, the administrator also wants to avoid installing software on the restricted servers unless absolutely necessary. Which solution BEST meets these requirements?
- A
Use an agentless scanner for all systems because it can assess devices remotely without requiring any endpoint components
- B
Deploy client-based agents to the laptops and use agentless scanning for the restricted servers
- C
Deploy client-based agents to the restricted servers only, and use agentless scanning for the laptops
- D
Use only unauthenticated network scans because they reduce administrative overhead and provide the same patch visibility as authenticated scans
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use a hybrid approach: client-based agents for roaming endpoints and agentless scanning where installing endpoint software is undesirable. In vulnerability management, client-based scanning places an agent on the endpoint, which improves visibility for devices that are remote, intermittently connected, or outside normal scanning ranges. Agentless scanning usually queries systems remotely over the network, often using authenticated access for better results, and is useful when organizations want to avoid deploying endpoint software. Security best practices and vendor guidance from major vulnerability management platforms consistently distinguish these tradeoffs: agents improve coverage and persistence for mobile devices, while agentless approaches reduce endpoint footprint but depend more on network access and reachability. This question tests the ability to select the right assessment method based on operational constraints rather than simply recalling definitions.
- A. Incorrect.
This is incorrect because agentless scanning can be useful for broad coverage, but it is not the best fit for laptops that are frequently off the corporate network. Agentless methods typically rely on network reachability and, when used without an installed agent, may miss systems that are offline, remote, or intermittently connected. It also does not align with the requirement for the most accurate visibility on roaming laptops.
- B. Correct.
This is correct because client-based agents are well suited for laptops that leave the office. Agents can continue collecting vulnerability, patch, and configuration data even when systems are not currently reachable from an internal scanner, then report back when connectivity is available. Using agentless scanning for the restricted servers also matches the requirement to avoid installing software there unless necessary. This is a practical hybrid deployment model used in many environments.
- C. Incorrect.
This is incorrect because it reverses the stated requirements. Restricted servers are the systems where the administrator wants to avoid installing software, so making them client-based would conflict with that goal. In contrast, laptops that frequently leave the network benefit most from client-based agents due to intermittent connectivity.
- D. Incorrect.
This is incorrect because unauthenticated scans generally provide less detailed results than authenticated or agent-based assessments. They may identify exposed services and some externally observable issues, but they do not usually provide the same depth of insight into installed patches, local software versions, or insecure internal configurations. Choosing this option reflects a common misconception that lower overhead provides equivalent accuracy.