Which of the following network vulnerability scan indicators BEST validates a successful, active scan?

Scheduling a scan during off-peak hours is a best practice for operational management and minimizing impact, not an indicator of the scan's technical success in identifying vulnerabilities.

Listing SQL injection attack vectors in scan output confirms that the vulnerability scanner actively probed target systems and successfully identified specific exploitable weaknesses. This direct finding of a vulnerability type, such as those that allow unauthorized data access or manipulation, validates the scan's effectiveness in assessing the system's security posture.

While an authenticated scan might use or find privileged credentials, simply identifying 'the use of privileged-user credentials' does not, on its own, validate the successful discovery of *exploitable vulnerabilities*.

Identifying hostnames and IP addresses is a basic network discovery function that confirms host presence and reachability, but it does not indicate that a vulnerability scan successfully identified any security weaknesses.