A change freeze bars any authenticated logins to a set of production database servers during business hours, yet leadership wants ongoing vulnerability visibility with no added load or logins on those hosts. An analyst is choosing a scanning approach that respects the freeze while still reporting exposures. Which approach BEST fits these constraints?
- ADeploy a credentialed active scan scheduled to authenticate to each server every hour throughout the day.
- BRun an aggressive unauthenticated active scan against the servers, limited to a single sweep at midday.
- CUse passive scanning that analyses mirrored network traffic to and from the servers to infer running services and exposures. Correct
- DInstall a local scanning agent on each database server to collect and report configuration data on a schedule.
Why A is wrong: Tempting because credentialed scans give the richest data, but authenticating hourly is exactly the login activity the freeze prohibits, so it breaches the stated constraint.
Why B is wrong: Tempting because it avoids logins, but an aggressive active scan sends probes directly to the hosts and adds load, which the requirement to avoid added load rules out.
Why C is correct: Correct: passive scanning inspects a copy of the traffic and never touches or logs into the hosts, giving continuous visibility without added load or logins, which satisfies every constraint.
Why D is wrong: Tempting because agents avoid network scans, but installing and running an agent adds host load and typically needs privileged access during a freeze, conflicting with the no-added-load requirement.