Sara, the Chief Information Officer (CIO), has requested an audit take place to determine what services and operating systems are running on the corporate network. Which of the following should be…

Password crackers are used to recover credentials from hashed or encrypted values and contribute nothing to auditing services or operating systems.

Fuzzing sends malformed or random input to applications to find vulnerabilities and is not a technique for discovering what services or OSes are running.

A vulnerability scan identifies known weaknesses in discovered services but fuzzing is still irrelevant to the goal of inventorying services and operating systems.

A port scan (using tools like Nmap) probes each host to determine which TCP/UDP ports are open, revealing the services running on the network. OS and service fingerprinting then analyzes response characteristics such as TCP stack behavior or service banners to identify the specific operating system and software versions. Together these two techniques directly satisfy the CIO's request to inventory services and operating systems.