312-50 Question 121
Single answer▪ Vulnerability Assessment ToolsA security consultant is performing an internal vulnerability assessment of a production network that includes several legacy servers and bandwidth-constrained WAN links to remote offices. The client wants a broad view of missing patches, weak services, and exposed misconfigurations, but has warned that aggressive checks could disrupt fragile systems. Which approach best meets the client’s requirement while minimizing operational risk?
- A
Run a credentialed vulnerability scan with safe-check or non-intrusive settings enabled, then review and validate high-risk findings before remediation
- B
Use a packet-crafting tool to fuzz all discovered services so the scan identifies every potential denial-of-service condition
- C
Perform a full exploit-based assessment against each host to confirm only vulnerabilities that are definitely exploitable
- D
Limit the assessment to a simple ICMP sweep and TCP port scan, because vulnerability scanners are too disruptive for production environments
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use a credentialed vulnerability assessment tool configured for safe or non-intrusive checks. In real environments, tools such as Tenable Nessus, Qualys, and Rapid7 InsightVM/Nexpose support credentialed scanning and provide options to reduce scan intensity, avoid dangerous checks, and manage performance impact. Credentialed scans typically improve detection of patch status, local configuration weaknesses, and unsupported software while reducing reliance on inference from open ports alone. Best practice is to schedule scans carefully, throttle where needed for low-bandwidth links, enable safe checks for fragile systems, and validate critical findings before remediation or escalation. This aligns with common vendor guidance and industry practice for production vulnerability management, where the objective is risk identification with minimal service disruption rather than exploit confirmation.
- A. Correct.
Correct. A credentialed vulnerability scan is the most appropriate approach when the goal is to identify missing patches, insecure services, and system misconfigurations with higher accuracy and lower false positives than unauthenticated scanning alone. Enabling safe checks or non-intrusive options helps reduce the chance of service disruption on fragile production systems. Reviewing and validating high-risk findings before remediation is also consistent with best practice because vulnerability scanners can still produce false positives or findings that need contextual analysis.
- B. Incorrect.
Incorrect. Fuzzing services with packet-crafting techniques is not the right first-line method for a production vulnerability assessment, especially on legacy systems and constrained links. Fuzzing is more aligned with robustness or application security testing and can easily destabilize services. The misconception is that more aggressive testing automatically provides better vulnerability coverage; in production, safety and scope control are critical.
- C. Incorrect.
Incorrect. An exploit-based assessment is much more invasive than a standard vulnerability scan and introduces unnecessary operational risk in a production environment. While exploitation can confirm true positives, it is generally reserved for authorized penetration testing phases with explicit approval and strong change-control safeguards. The misconception here is that confirmation by exploitation is required for all assessments; vulnerability assessment and penetration testing are related but distinct activities.
- D. Incorrect.
Incorrect. An ICMP sweep and TCP port scan may help with asset discovery and service enumeration, but they do not provide the broad vulnerability visibility the client requested, such as missing patches and insecure configurations. The misconception is that production concerns mean scanners should be avoided entirely; in reality, properly configured vulnerability scanners are commonly used in production with throttling, safe checks, scheduling, and credentialed access.