A penetration tester has run multiple vulnerability scans against a target system. Which of the following would be unique to a credentialed scan?

A credentialed scan logs into the target using valid credentials and can enumerate exact software versions, patch levels, and registry values from inside the system. This internal visibility allows the scanner to definitively confirm whether a known CVE applies and identify the specific exploit that targets it. An unauthenticated scan can only infer potential vulnerabilities from external network responses and cannot confirm exploitability with the same precision.

Detailed service configurations can be partially discovered without credentials through banner grabbing and service fingerprinting, so they are not unique to credentialed scans.

Unpatched third-party software can sometimes be detected by unauthenticated scans via version banners or HTTP headers, so this finding is not exclusive to credentialed scanning.

Weak access control configurations such as exposed services or default credentials can be identified through unauthenticated probing, making them accessible to non-credentialed scans as well.