Limitations of Vulnerability Assessment in Legacy and Default Configurations
In the process of implementing a network vulnerability assessment strategy for a tech company, the security analyst is confronted with the following scenarios: 1) A legacy application is discovered on the network, which no longer receives updates from the vendor. 2) Several systems in the network are found running outdated versions of web browsers prone to distributed attacks. 3) The network firewall has been configured using default settings and passwords. 4) Certain TCP/IP protocols used in the organization are inherently insecure. The security analyst decides to use vulnerability scanning software. Which of the following limitations of vulnerability assessment should the analyst be most cautious about in this context?
Community Votes
71% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The core trap is confusing technical detection capability with business context; scanners identify CVEs but lack the organizational knowledge to define their specific operational impact.
This question examines the critical limitations of vulnerability scanning software when dealing with legacy applications and insecure protocols. It establishes that scanners cannot assess business impact, making risk prioritization a manual task.
Many candidates select C (point-in-time limitation) because it is technically true for all scans. However, this option is too generic and does not address the specific failure mode regarding 'impact' described in the scenario's context of business operations.
Community Discussion (7 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Correct answer: A — Vulnerability scanning software cannot define the impact of an identified vulnerability on different business operations. The scenario highlights high-risk environments (legacy apps, default configs, insecure protocols). While a scanner can flag these as vulnerabilities, it lacks the contextual intelligence to determine how each flaw affects specific business processes or revenue streams. This distinction between 'technical severity' and 'business impact' is a fundamental limitation of automated assessment tools.Why the Other Options Are Wrong
Option B is incorrect because while scanners can have flaws, the primary limitation in this context is the inability to interpret business context, not the scanner's own code integrity. Option C is a valid general limitation (snapshots), but it is less relevant than A because the scenario emphasizes the nature of the vulnerabilities (legacy/insecure) rather than their temporal state. Option D is incorrect because modern scanners do perform live web application testing; the limitation here is broader than just web errors.Community Comment Notes
Community discussion reflects a split between those who recognize the 'context gap' and those focused on technical mechanics. As insaniunt noted, the key is that scanning tools "cannot define the impact." Conversely, users like brrbrr argued for C, stating that scans are merely a "snapshot," but this misses the specific nuance of business operation impact required by the question's framing.Exam Strategy
Always distinguish between what a tool can detect (technical finding) and what it can evaluate (business consequence). In CEH exams, if a scenario mentions 'business impact,' 'risk prioritization,' or 'organizational context,' the answer is usually that automated tools cannot provide this without human analysis.
Frequently Asked Questions
Why isn't C (point-in-time) the best answer?
While scans are snapshots, option A addresses the specific failure to prioritize risks based on business value, which is the deeper limitation highlighted by the legacy/default config context.
Can scanners ever determine business impact?
No, scanners provide technical data (CVSS scores). Business impact requires manual assessment by security analysts who understand the organization's specific workflows and dependencies.