Which of the following should a security analyst perform FIRST to determine the vulnerabilities of a legacy system?

A passive scan gathers information without directly interacting with or risking the stability of a potentially fragile legacy system. This non-intrusive method is crucial as a first step to identify basic vulnerabilities and gather intelligence without causing service interruptions or system failures on critical, sensitive, or unstable infrastructure.

Aggressive scans actively probe the system and could disrupt fragile legacy systems, making them unsuitable as a first step.

Credentialed scans require direct access and elevated privileges, making them more intrusive than a passive scan and typically not the first step for initial discovery on a potentially unknown legacy system.

Intrusive scans directly interact with the system and carry a higher risk of disruption, making them inappropriate as a first step for a legacy system.