Which of the following techniques does a vulnerability scanner use in order to detect a vulnerability on a target service?

Port scanning identifies which ports are open and services are listening, but does not by itself determine whether those services contain vulnerabilities.

Banner grabbing retrieves version information from a service and is a reconnaissance step that can precede vulnerability identification, but it alone does not confirm a vulnerability is present.

Injecting arbitrary data is a technique associated with exploitation or fuzzing, not standard vulnerability scanning, which uses non-destructive probes and response analysis.

Vulnerability scanners send specific requests or payloads to a target service and then analyze the response - including response codes, headers, body content, error messages, and timing - to match against known vulnerability signatures. This response analysis is what distinguishes a vulnerability scanner from a simple port scanner; it determines whether a specific flaw, misconfiguration, or vulnerable version is actually present and exploitable on the target.