Morris, a professional hacker, performed a vulnerability scan on a target organization by sniffing the traffic on the network lo identify the active systems, network services, applications, and vulner

An internal assessment describes the physical or logical position of the assessor (inside the network perimeter) and does not specifically refer to using credentials for deep authenticated inspection of systems and user sessions.

A passive assessment involves only capturing and analyzing existing network traffic without interacting with or probing hosts, which would not yield detailed application vulnerability data or enumerate currently active user sessions.

An external assessment simulates an outside attacker by scanning exclusively from outside the organizational network boundary, which contradicts Morris's insider-level visibility into user sessions and internal services.

A credentialed assessment leverages valid credentials or privileged network access to gather detailed information beyond what unauthenticated scanning can reveal, including active user sessions and installed application vulnerabilities. Morris's ability to enumerate currently logged-in users and identify application-level vulnerabilities indicates he had authenticated or elevated access to the network, which is the defining characteristic of a credentialed assessment.