CS0-004 - Vulnerability Management (26% of the exam) - Section 2.1
Given a scenario, implement the appropriate vulnerability scanning method.
Choose the appropriate scanning method for the target and goal: credentialed versus non-credentialed, agent-based versus agentless, internal versus external, active versus passive, and static versus dynamic application analysis. Account for scan scope, scheduling, fragile assets and regulatory constraints so the method fits the environment without disrupting operations.
credentialed vs non-credentialed scanningagent-based vs agentlessactive vs passive scanninginternal vs external scanningSAST vs DAST
A change freeze bars any authenticated logins to a set of production database servers during business hours, yet leadership wants ongoing vulnerability visibility with no added load or logins on those hosts. An analyst is choosing a scanning approach that respects the freeze while still reporting exposures. Which approach BEST fits these constraints?
ADeploy a credentialed active scan scheduled to authenticate to each server every hour throughout the day.
BRun an aggressive unauthenticated active scan against the servers, limited to a single sweep at midday.
CUse passive scanning that analyses mirrored network traffic to and from the servers to infer running services and exposures.check_circle Correct
DInstall a local scanning agent on each database server to collect and report configuration data on a schedule.
Passive scanning provides continuous exposure visibility without touching or authenticating to the target hosts, fitting no-login, no-load constraints. Passive scanning reads mirrored or tapped traffic rather than probing endpoints, so it imposes no load on the targets and requires no credentials. That makes it the approach that respects a login freeze and a no-added-load rule while still reporting observable exposures.
Why A is wrong: Tempting because credentialed scans give the richest data, but authenticating hourly is exactly the login activity the freeze prohibits, so it breaches the stated constraint.
Why B is wrong: Tempting because it avoids logins, but an aggressive active scan sends probes directly to the hosts and adds load, which the requirement to avoid added load rules out.
Why C is correct: Correct: passive scanning inspects a copy of the traffic and never touches or logs into the hosts, giving continuous visibility without added load or logins, which satisfies every constraint.
Why D is wrong: Tempting because agents avoid network scans, but installing and running an agent adds host load and typically needs privileged access during a freeze, conflicting with the no-added-load requirement.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CS0-004 bank for this domain.
SAST can only be performed against a live production deployment, while DAST works exclusively on source files.
errorWhy it is wrong: Tempting because it names both techniques, but the roles are reversed: SAST reads code and DAST needs a running instance.
Agent-based scanning requires the scanner to hold domain administrator credentials for every subnet, while agentless scanning never needs any credentials at all.
errorWhy it is wrong: Tempting because credentials often accompany scanning, but agents authenticate locally without central domain admin rights, and agentless credentialed scans do use credentials, so the credential claim is wrong on both halves.
Static application security testing, because it parsed the application code paths to trace the tainted search parameter to the output.
errorWhy it is wrong: Tempting because taint tracing is a real SAST technique, but SAST needs source or bytecode; here the tool only had the running URL and observed a live HTTP response.