Which of the following would MOST likely appear in an uncredentialed vulnerability scan?

Self-signed certificates are exposed during the TLS/SSL handshake and are fully visible to any external scanner without requiring authentication. An uncredentialed scanner can inspect the certificate presented by a service on an open port, making this the type of finding most likely discovered without credentials. No login or system access is needed to evaluate certificate properties such as issuer, expiration, or trust chain.

Missing patches require authenticated access to query the operating system or package manager for installed software versions, which is only possible with a credentialed scan.

Auditing parameters such as log settings, audit policies, and security configurations reside within the OS and require credentialed access to read registry keys, configuration files, or Group Policy settings.

Inactive local accounts are stored in the operating system's user database (e.g., SAM database on Windows), which requires authenticated/credentialed access to enumerate and evaluate.