Which of the following business challenges could be solved by using a vulnerability scanner?

Auditing naming conventions is a configuration management or asset inventory function, not a capability of vulnerability scanners, which focus on security weaknesses.

Determining whether additional systems were compromised after an incident requires forensic analysis and endpoint detection tools, not a vulnerability scanner.

Removing administrator access from machines is an identity and access management operation performed via directory services or endpoint management tools, not a vulnerability scanning function.

Vulnerability scanners can be configured with compliance benchmarks (such as CIS or STIG profiles) to test whether systems meet defined security and application usage policies on a scheduled basis. This aligns directly with a monthly compliance testing requirement, as the scanner identifies deviations from the accepted baseline across all in-scope hosts. Automated recurring scans make this operationally practical at scale.