A technician has installed new vulnerability scanner software on a server that is joined to the company domain. The vulnerability scanner is able to provide visibility over the patch posture of all…

Gray box vulnerability testing refers to a type of penetration test where the tester has some internal knowledge, but it describes the overall testing methodology rather than the specific method a scanner uses to gather patch posture information.

A passive scan collects information without directly interacting with the target system, such as by sniffing network traffic, which would not provide the detailed patch posture visibility described.

A credentialed scan involves providing the vulnerability scanner with valid authentication credentials (e.g., domain administrator accounts) to log into target systems and perform an in-depth, authenticated assessment. This allows the scanner to directly query local system information such as installed software, missing patches, and configuration settings, thereby accurately assessing and providing detailed visibility into the patch posture of all client machines.

Bypassing security controls refers to circumventing protective measures, which is a malicious act or an advanced exploitation technique, not a standard method for legitimate vulnerability scanning to assess patch posture.