SY0-701 Question 70
Single answerVulnerable software: Client-based vs. agentlessA security administrator is deploying a vulnerability management program across a hybrid environment that includes on-premises servers, employee laptops that often leave the corporate network, and a small group of legacy systems that cannot tolerate additional software installation. Leadership wants the most complete vulnerability data possible from remote laptops, but the administrator must also avoid disrupting the legacy systems. Which approach BEST meets these requirements?
- A
Use agentless vulnerability scanning for all systems so no endpoint software is required anywhere
- B
Deploy client-based agents to employee laptops and use agentless scanning for the legacy systems
- C
Install client-based agents on the legacy systems and perform agentless scans on the employee laptops
- D
Avoid vulnerability scanning on legacy systems and only assess the employee laptops with authenticated scans
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use a mixed approach: client-based agents for systems that need continuous visibility, especially remote endpoints, and agentless scanning for systems where installing software is not practical or safe. In vulnerability management, client-based agents are commonly preferred for mobile endpoints because they can collect data regardless of whether the device is currently reachable by a scanner. Agentless methods are useful when software installation is restricted, such as on sensitive or legacy systems, but they rely on network access, credentials when authenticated scanning is used, and the target being available during scans. This aligns with common industry guidance from vulnerability management vendors and best practices such as maintaining asset coverage while minimizing operational impact to fragile systems. The key distinction is that agent-based approaches improve visibility for roaming endpoints, while agentless approaches reduce endpoint footprint but depend more heavily on network accessibility and scan timing.
- A. Incorrect.
This is incorrect because using only agentless scanning would reduce deployment complexity, but it would not best meet the requirement for the most complete data from laptops that frequently leave the corporate network. Agentless scanning typically depends on network reachability and often misses systems that are offline, roaming, or not connected during scan windows.
- B. Correct.
This is correct because client-based agents are well suited for employee laptops that move in and out of the network. Agents can continue collecting vulnerability and configuration data even when devices are remote, and they can report back when connectivity is available. Agentless scanning is the safer choice for legacy systems that cannot tolerate additional software installation, assuming those systems can still be scanned over the network in a controlled manner.
- C. Incorrect.
This is incorrect because it reverses the appropriate use cases. Installing agents on fragile legacy systems conflicts with the stated requirement to avoid adding software that could disrupt them. Using only agentless scans for roaming laptops also makes it harder to maintain visibility when those devices are off-network or unavailable during scheduled scans.
- D. Incorrect.
This is incorrect because excluding legacy systems from vulnerability assessment creates a coverage gap and increases risk. While authenticated scans can improve agentless results on laptops, they still do not provide the same continuous visibility as client-based agents for devices that are frequently off the corporate network.