312-50 Question 112
Single answer▪ Vulnerability Assessment ConceptsA security consultant is performing a vulnerability assessment for a hospital network that includes legacy medical devices, Windows servers, and internet-facing web applications. The hospital's change-control board has stated that patient-care systems must not be disrupted, and the consultant has only a 24-hour assessment window. Which approach is the MOST appropriate for identifying the largest number of likely vulnerabilities while minimizing the risk of service interruption?
- A
Run a credentialed vulnerability scan on supported servers and workstations, use carefully scoped non-intrusive checks for medical devices, and validate critical findings on internet-facing applications manually before reporting
- B
Launch a full unauthenticated scan with all available vulnerability plugins against every subnet so the assessment remains non-invasive and finishes quickly
- C
Perform active exploitation of all high-severity findings first to confirm impact, then document only the vulnerabilities that successfully compromise a host
- D
Rely primarily on network sniffing and banner grabbing to avoid touching hosts directly, then classify any outdated software version as a confirmed exploitable vulnerability
Show answer and explanation
Correct answer: A
Explanation
The best answer is the risk-based, mixed-method approach in Option 1. In vulnerability assessment, the goal is to identify and prioritize weaknesses with sufficient accuracy while respecting operational constraints. In production environments with sensitive systems, especially healthcare and OT-like medical devices, assessors commonly combine credentialed scanning where supported, reduced-impact checks for fragile assets, and manual verification of critical externally exposed findings. This balances coverage, accuracy, and safety.
Industry best practices support this approach. Credentialed scans are widely recommended by major vulnerability management vendors and security guidance because they reduce false positives and reveal configuration issues that network-only scans often miss. For sensitive or legacy systems, organizations such as CISA and many device vendors recommend caution with active scanning due to the potential for instability. Additionally, validating critical web application findings manually is consistent with common assessment methodology because automated tools can misidentify severity or exploitability.
Key CEH concept tested here: vulnerability assessment is not the same as penetration testing. A vulnerability assessment focuses on systematic identification, measurement, and prioritization of weaknesses, typically with minimal disruption, whereas penetration testing more commonly includes exploitation to demonstrate impact.
- A. Correct.
Correct. This approach aligns with vulnerability assessment best practices in sensitive environments. Credentialed scanning generally provides higher-fidelity results on supported systems because it can inspect patch levels, local configurations, missing updates, and insecure settings more accurately than unauthenticated scans. For fragile or legacy medical devices, limiting checks to carefully scoped, non-intrusive techniques reduces the chance of disruption. Manually validating critical findings on internet-facing applications helps reduce false positives before reporting, which is especially important when time is limited and remediation decisions may affect critical services.
- B. Incorrect.
Incorrect. An unauthenticated scan does not remain non-invasive simply because credentials are not used. Aggressive plugin sets across every subnet can still create significant load and may disrupt fragile systems, especially legacy or embedded devices. In addition, unauthenticated scans usually provide lower accuracy than credentialed scans for internal assets, increasing false positives and false negatives.
- C. Incorrect.
Incorrect. Active exploitation is generally associated with penetration testing, not a standard vulnerability assessment, and it introduces unnecessary operational risk in a hospital environment. The scenario specifically emphasizes minimizing service interruption. Also, documenting only successfully exploited issues would ignore many valid vulnerabilities that were identified but not exploited, which is not how vulnerability assessments are typically conducted.
- D. Incorrect.
Incorrect. Passive methods such as sniffing and banner grabbing can be useful for reconnaissance and low-impact discovery, but they are not sufficient for identifying the largest number of likely vulnerabilities across diverse assets. Banner versions alone also do not prove exploitability; version-based matching can be misleading because of backported fixes, custom builds, or masked banners. Treating every outdated version as a confirmed exploitable vulnerability is an example of poor validation.