CS0-003 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  They are less likely to crash services

  Why it's wrong here

  Crash likelihood is driven mainly by which probes and exploit checks the scanner fires at a service over the network, not by whether it has host credentials, so a credentialed scan can still trigger the same intrusive checks and destabilize a fragile service just as easily as an unauthenticated one.

• ✓

  They provide more accurate results by checking internal configurations

  Why this is correct

  Logging in with valid credentials lets the scanner query installed package versions, registry keys, running services, and local patch levels directly from the OS, producing far fewer false positives and negatives than inferring vulnerabilities purely from external banners and network responses.

• ✗

  They are faster and less intrusive

  Why it's wrong here

  Credentialed scans authenticate to the target, so they enumerate installed software, patch levels and local configuration by querying the host rather than probing ports; they typically take longer and consume more target resources than unauthenticated scans. Speed and low intrusiveness describe network-layer discovery scanning, which is chosen when agentless, minimal-impact assessment is required.

• ✗

  They do not require network access

  Why it's wrong here

  A credentialed scan still connects over the network to reach the target host and then authenticates via protocols like SSH or WinRM/SMB to run local checks, so network reachability is required in both scan types; only the authentication step differs.

Go deeper

Related to this question