A client has asked for a vulnerability scan on an internal network that does not have internet access. The rules of engagement prohibits any outside connection for the Nessus scanning machine. The…

Connecting the scanning machine through a wireless bridge establishes an outside connection from the scanning machine itself, which directly violates the stated rules of engagement.

Changing routing to use an alternative gateway still routes the scanning machine's traffic to an external network, which is explicitly prohibited by the rules of engagement.

Proceeding without the updated plugins leaves the critical vulnerability untested, producing an incomplete assessment that does not meet the client's explicit request to scan for that vulnerability.

Downloading the updated Nessus plugins on a separate machine that is authorized to access the internet, then transferring the update files to the scanning machine via removable media or an internal file transfer, keeps the scanning machine isolated from any outside connection. This method satisfies both the operational requirement for current plugins and the contractual rules of engagement that prohibit the scanner itself from connecting externally.