A systems administrator wants to verify the word "qwerty" has not been used as a password on any of the administrative web consoles in a network. Which of the following will achieve this goal?

A service availability scan only determines whether a service is reachable and responding; it does not attempt authentication or evaluate password strength.

An agent-based vulnerability scan uses an installed agent to enumerate software versions and misconfigurations for known CVEs; it does not perform login attempts against web console credential forms.

A default and common credentialed scan systematically attempts to log in to discovered services and web consoles using a dictionary of well-known weak and default passwords, including entries like 'qwerty', 'password', and 'admin'. This directly validates whether any administrative interface accepts the target password by performing an actual authentication attempt. It is the only scan type listed that tests credential validity rather than just checking reachability or known CVEs.

A network port scan identifies open ports and infers running services but performs no authentication and cannot detect whether a specific password is accepted by any service.