CS0-003 · Question #505
An analyst is creating the final vulnerability report for one of the company's customers. The customer asks for a scanning profile with a CVSS score of 7 or higher. The analyst has confirmed there…
The correct answer is A. The server was offline at the moment of the scan. If a vulnerability scan finds no missing database patches, despite manual checks eliminating false positives, the most probable reason for the missing result is that the server was offline during the scan.
Question
An analyst is creating the final vulnerability report for one of the company's customers. The customer asks for a scanning profile with a CVSS score of 7 or higher. The analyst has confirmed there is no finding for missing database patches, even if false positives have been eliminated by manual checks. Which of the following is the most probable reason for the missing scan result?
Options
- AThe server was offline at the moment of the scan.
- BThe system was not patched appropriately before the scan.
- CThe scan finding does not match the requirement.
- DThe output of the scan is corrupted.
How the community answered
(38 responses)- A71% (27)
- B8% (3)
- C18% (7)
- D3% (1)
Why each option
If a vulnerability scan finds no missing database patches, despite manual checks eliminating false positives, the most probable reason for the missing result is that the server was offline during the scan.
If a server hosting a database is offline during a vulnerability scan, the scanner would be unable to connect to or assess that system. This would result in no findings for missing database patches, or any other vulnerabilities on that server, because the system was simply unreachable rather than being securely configured or patched.
If the system was not patched appropriately, the scan *should* have identified missing patches, directly contradicting the scenario where no finding for missing database patches was present.
The customer requested a profile with CVSS 7 or higher, implying such vulnerabilities *should* be reported if found; this option doesn't explain the *absence* of findings for *missing database patches* specifically, especially after false positives are eliminated.
Corrupted scan output might lead to unreadable data or errors, but it is less probable than an offline server for a complete absence of a specific type of finding after manual verification.
Concept tested: Vulnerability scanning common issues (offline hosts)
Topics
Community Discussion
No community discussion yet for this question.