CEH Footprinting, Reconnaissance and Scanning Practice Question

A security analyst is conducting a vulnerability scan on a web server using Nessus. After the scan, they notice that the server's performance has degraded significantly, and some services have become unresponsive. Which of the following actions could have prevented this issue?

⚠ Common exam trap

Many candidates think using a different scanner (Option C) or adjusting timing (Option D) solves the problem, but the core issue is the use of disruptive plugins, which is directly controlled by the scan policy, not the scanner brand or schedule.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Configure Nessus to use a 'safe' scan policy that disables disruptive plugins

Nessus 'safe' scan policies disable plugins known to cause service disruption, such as those performing denial-of-service tests or exploiting vulnerabilities that may crash services. By using a safe policy, the analyst avoids aggressive checks that can degrade server performance or cause unresponsiveness, which is a common risk during vulnerability scanning.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Increase the scan intensity to complete faster and reduce the load
Why it's wrong here
Increasing scan intensity, which often translates to more concurrent checks, faster packet rates, or deeper enumeration, will significantly increase the load on the target system and network, not reduce it. This heightened activity can easily overwhelm services, consume excessive CPU and memory, and saturate network links, leading to performance degradation or even denial of service for legitimate users. While it might complete the scan faster, it does so at the unacceptable risk of operational disruption.
✓
Configure Nessus to use a 'safe' scan policy that disables disruptive plugins
Why this is correct
Configuring Nessus with a 'safe' scan policy is the most appropriate action because it specifically disables plugins known to be disruptive or potentially harmful to target systems. These plugins often include checks that perform denial-of-service tests, brute-force authentication attempts, or highly resource-intensive operations that could crash services or cause system instability. By avoiding these aggressive checks, the scan can identify vulnerabilities without negatively impacting the availability or performance of critical systems.
✗
Use a different scanner like OpenVAS which is less intrusive
Why it's wrong here
Switching to a different scanner like OpenVAS does not inherently guarantee a less intrusive scan, as intrusiveness is primarily determined by the scan policy and plugin configuration, not solely the scanner brand. Both Nessus and OpenVAS offer a wide range of plugins, some of which are highly aggressive and can cause system instability if enabled. Without configuring a 'safe' or 'non-disruptive' policy in OpenVAS, it could be just as intrusive as a misconfigured Nessus scan.
✗
Run the scan during peak hours to blend in with normal traffic
Why it's wrong here
Running a vulnerability scan during peak hours is counterproductive for minimizing impact, as it would add substantial artificial traffic and resource demands on top of an already busy operational environment. This additional load would exacerbate network congestion and system resource contention, making performance degradation more likely and potentially causing outages for legitimate users. Furthermore, the distinct patterns of scan traffic are often easily identifiable, making "blending in" an ineffective strategy.

Go deeper

CEH Footprinting, Reconnaissance and Scanning Practice Question

Why each option matters

Option-by-option breakdown

Related to this question