Which feature is used to find possible vulnerable services running on a server?

CPU utilization is a performance metric that shows how busy the processor is, not which services are exposed on the network.

A security policy is a set of rules and guidelines governing acceptable use and controls, not a technical tool for discovering running services.

Temporary internet files are cached browser data stored on a client machine and have no relationship to services listening on a server.

Every network service (such as HTTP, SSH, FTP, or SMB) binds to a specific port and enters a listening state waiting for connections. A port scan identifies which ports are open, directly mapping to which services are running. Security analysts use this technique to discover unnecessary or unpatched services that represent an attack surface.