CISSP Security Assessment and Testing Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Can detect vulnerabilities that require valid credentials to be seen

  Why this is correct

  Authenticated scans operate with valid credentials, allowing them to access the internal configuration, file systems, and running processes of a target system. This deep access enables the detection of vulnerabilities that are only visible post-authentication, such as misconfigurations in internal services, insecure file permissions, or unpatched software versions that an unauthenticated scan might miss entirely.

• ✗

  Reduces network traffic

  Why it's wrong here

  Authenticated vulnerability scans typically generate *more* network traffic, not less. By logging into systems, the scanner performs deeper, more granular checks, querying system configurations, installed software, patch levels, and file permissions directly. This extensive data collection and interaction with the target system's internal state inherently requires more network communication than a superficial, unauthenticated scan that only probes external services.

• ✗

  Eliminates false positives entirely

  Why it's wrong here

  While authenticated scans significantly reduce false positives compared to unauthenticated scans due to their ability to verify actual patch levels and configurations, they do not eliminate them entirely. False positives can still arise from misinterpretations of system data, incomplete vulnerability definitions, or environmental factors that lead the scanner to incorrectly flag a non-vulnerable condition as a risk. No automated scanning technology can guarantee 100% accuracy.

• ✓

  Provides more accurate patch-level information

  Why this is correct

  Authenticated vulnerability scans provide significantly more accurate patch-level information because they can directly query the operating system and installed applications for their exact version numbers and installed updates. By logging in, the scanner can access system registries, package managers, or file system metadata to confirm whether specific security patches have been successfully applied, rather than relying on less reliable banner grabbing or service fingerprinting. This direct verification reduces uncertainty and improves remediation prioritization.

• ✗

  Does not require network access

  Why it's wrong here

  Authenticated vulnerability scans absolutely require network access to the target systems. While they use credentials to gain deeper access *within* the system, the initial connection, credential transmission, and subsequent data exchange between the scanner and the target all occur over the network. The scanner needs to communicate with the target's operating system or management agents to perform its checks, making network connectivity a fundamental prerequisite.

Go deeper

Related to this question