CS0-004 - Vulnerability Management - Section 2.1

Given a scenario, implement the appropriate vulnerability scanning method.

Choose the appropriate scanning method for the target and goal: credentialed versus non-credentialed, agent-based versus agentless, internal versus external, active versus passive, and static versus dynamic application analysis. Account for scan scope, scheduling, fragile assets and regulatory constraints so the method fits the environment without disrupting operations.

credentialed vs non-credentialed scanningagent-based vs agentlessactive vs passive scanninginternal vs external scanningSAST vs DAST

Practice question for this objective

Free sampleVulnerability Managementmedium

A change freeze bars any authenticated logins to a set of production database servers during business hours, yet leadership wants ongoing vulnerability visibility with no added load or logins on those hosts. An analyst is choosing a scanning approach that respects the freeze while still reporting exposures. Which approach BEST fits these constraints?

  • ADeploy a credentialed active scan scheduled to authenticate to each server every hour throughout the day.
  • BRun an aggressive unauthenticated active scan against the servers, limited to a single sweep at midday.
  • CUse passive scanning that analyses mirrored network traffic to and from the servers to infer running services and exposures. Correct
  • DInstall a local scanning agent on each database server to collect and report configuration data on a schedule.
Passive scanning provides continuous exposure visibility without touching or authenticating to the target hosts, fitting no-login, no-load constraints. Passive scanning reads mirrored or tapped traffic rather than probing endpoints, so it imposes no load on the targets and requires no credentials. That makes it the approach that respects a login freeze and a no-added-load rule while still reporting observable exposures.

Why A is wrong: Tempting because credentialed scans give the richest data, but authenticating hourly is exactly the login activity the freeze prohibits, so it breaches the stated constraint.

Why B is wrong: Tempting because it avoids logins, but an aggressive active scan sends probes directly to the hosts and adds load, which the requirement to avoid added load rules out.

Why C is correct: Correct: passive scanning inspects a copy of the traffic and never touches or logs into the hosts, giving continuous visibility without added load or logins, which satisfies every constraint.

Why D is wrong: Tempting because agents avoid network scans, but installing and running an agent adds host load and typically needs privileged access during a freeze, conflicting with the no-added-load requirement.

See more CS0-004 practice questions, answers explained.

More in this domain

Back to all Vulnerability Management objectives, or the CS0-004 cert hub.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.