312-50 Question 113
Single answer▪ Vulnerability Assessment ConceptsA security consultant is performing a vulnerability assessment for a hospital network that includes legacy patient-monitoring systems and newer Windows servers. The hospital requires the consultant to identify likely weaknesses quickly, but any activity that could disrupt fragile medical devices is prohibited. Which approach is the MOST appropriate to meet this requirement?
- A
Run a credentialed vulnerability scan against all systems using default safe checks only
- B
Perform a non-intrusive vulnerability assessment that relies on passive discovery, banner analysis, and vulnerability correlation from version information
- C
Launch a full exploitation framework against sampled hosts to validate every suspected vulnerability before reporting
- D
Conduct an aggressive unauthenticated scan with service enumeration, OS fingerprinting, and packet fragmentation to avoid missing vulnerabilities
Show answer and explanation
Correct answer: B
Explanation
The key concept is selecting a vulnerability assessment method appropriate to the operational environment. In safety-critical networks, especially those containing legacy medical devices, assessors should favor the least intrusive techniques first. Passive discovery, banner grabbing from observed traffic or carefully collected metadata, and correlating software or firmware versions with known vulnerabilities can provide meaningful results with lower risk than active credentialed scanning or exploitation. In practice, this approach is consistent with common guidance for industrial, healthcare, and other fragile environments where availability and safety take priority. NIST guidance such as the Technical Guide to Information Security Testing and Assessment (SP 800-115) emphasizes rules of engagement and minimizing operational impact during assessments. Similarly, vulnerability management best practices from major scanner vendors distinguish between safe checks, authenticated scans, and passive assessment, with passive methods typically recommended where active probing may be unsafe.
- A. Incorrect.
This is not the most appropriate choice because credentialed scans, while highly accurate for supported systems, still actively interact with targets and may not be suitable for fragile legacy medical devices. Even with safe checks enabled, running against all systems can introduce risk in sensitive environments. A consultant might choose this because credentialed scans are a best practice for accuracy on standard enterprise assets, but the scenario emphasizes avoiding any potentially disruptive activity on legacy devices.
- B. Correct.
This is correct because passive discovery and version-based vulnerability correlation minimize direct interaction with sensitive systems while still allowing the assessor to identify likely weaknesses. In high-availability or safety-critical environments such as hospitals, non-intrusive techniques are often preferred for legacy or fragile assets. This aligns with vulnerability assessment concepts that prioritize risk reduction during assessment and use indirect evidence, such as observed services, banners, and known CVEs associated with identified versions.
- C. Incorrect.
This is incorrect because exploitation is generally part of penetration testing, not a low-impact vulnerability assessment. Using an exploitation framework to validate every finding increases operational risk and could disrupt clinical systems. Someone might choose this option because validated findings reduce false positives, but the scenario explicitly prohibits potentially disruptive activity.
- D. Incorrect.
This is incorrect because aggressive unauthenticated scanning increases the chance of service interruption, especially on legacy medical systems. Techniques like heavy service enumeration and OS fingerprinting can stress fragile devices. A candidate might select this option believing broader probing finds more issues, but the requirement is to identify likely weaknesses quickly without risking disruption.