A security analyst has set up a network tap to monitor network traffic for vulnerabilities. Which of the following techniques would BEST describe the approach the analyst has taken?

Compliance scanning checks systems against specific regulatory or policy benchmarks (e.g., CIS, PCI-DSS) and requires active querying of systems, not passive traffic monitoring via a tap.

Credentialed scanning uses valid login credentials to authenticate to target systems and perform deep configuration audits, which is an active technique unrelated to network tap monitoring.

Passive vulnerability scanning analyzes captured network traffic (such as via a tap or span port) to identify vulnerabilities without sending any probes - this is actually the most technically accurate description of the analyst's approach.

NOTE: The provided correct answer of D (Port scanning) appears incorrect based on the question context. The best answer should be C (Passive vulnerability scanning), as a network tap captures traffic passively without sending probes. Port scanning actively sends packets to target hosts to discover open ports, which does not align with using a network tap to monitor traffic. If D is truly the intended answer, it may reflect a flawed question, but passive scanning is the technically accurate match for network tap-based monitoring.