An analyst is performing a vulnerability scan against the web servers exposed to the internet without a system account. Which of the following is most likely being performed?

Question

Options

• ANon-credentialed scan
• BPacket capture
• CPrivilege escalation
• DSystem enumeration
• EPassive scan

• A
  90% (27)
• B
  3% (1)
• C
  7% (2)

Explanation

A non-credentialed scan (A) is correct because it describes a vulnerability scan performed without supplying system credentials - exactly what "without a system account" means. The scanner probes from an external, unauthenticated perspective, simulating what an outside attacker would see.

Why the others are wrong:

• B. Packet capture - passive traffic interception, not active scanning for vulnerabilities
• C. Privilege escalation - an attack technique to gain higher access after initial compromise, not a scan type
• D. System enumeration - gathering info about a system (users, services, shares), which can be part of a scan but isn't the scan type being described
• E. Passive scan - observes existing network traffic without sending probes; this question describes active probing of web servers

Memory tip: Think of "credentials = account." No account = non-credentialed. Credentialed scans go deeper (inside the OS); non-credentialed scans see only what an outsider sees. If the question mentions "internet-facing" + "no system account," that's your non-credentialed scan signal.

No community discussion yet for this question.