Agent-Based vs Network-Based Vulnerability Scanners
John, a disgruntled ex-employee of an organization, contacted a professional hacker to exploit the organization. In the attack process, the professional hacker installed a scanner on a machine belonging to one of the victims and scanned several machines on the same network to identify vulnerabilities to perform further exploitation. What is the type of vulnerability assessment tool employed by John in the above scenario?
Community Votes
56% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The key trap is confusing the tool's ability to scan multiple machines with its deployment model; network-based scanners typically target the infrastructure itself, whereas agent-based scanners reside on a host to coordinate local and peer scanning.
This question distinguishes between agent-based and network-based vulnerability assessment tools based on installation location and scanning scope. It establishes that installing a scanner on a single host to scan peers defines an agent-based approach.
Many learners select 'Network-based scanner' because the action involves scanning a network, overlooking the critical detail that the scanner software was installed on a specific victim machine rather than being a dedicated network appliance or remote probe.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is A (Agent-based scanner). In the scenario, the hacker installs the scanner software directly onto a compromised machine within the target environment. According to standard ethical hacking frameworks (such as EC-Council curriculum), an agent-based scanner resides on a single machine but can be configured to scan other machines on the same network. The defining characteristic here is the installation of the scanner on a host, which then acts as an agent for further reconnaissance.Why the Other Options Are Wrong
Option B (Network-based scanner) is incorrect because network-based scanners are typically standalone appliances or remote services that monitor network traffic or probe devices from an external or centralized point without necessarily residing on a compromised host as an active agent. Option C (Cluster scanner) refers to distributed scanning across multiple nodes, not a single-host install. Option D (Proxy scanner) involves routing requests through a proxy server, which is unrelated to the described installation method.Community Comment Notes
While the community vote was split, several users correctly identified Option A by citing the specific definition that agent-based scanners "reside on a single machine but can scan several machines on the same network." One commenter noted this aligns with Module 5 page 561 of the study guide. Others argued for B, mistakenly focusing on the "network scanning" action rather than the "installed on a machine" constraint. The distinction lies in the deployment: if it's installed on the host, it's an agent.Exam Strategy
When analyzing vulnerability scanner types, always look at where the software is deployed first. If it is installed on a specific endpoint/host, it is likely Agent-based. If it scans from a central location or monitors traffic flows without residing on the scanned hosts, it is Network-based.
Frequently Asked Questions
What is the difference between agent-based and network-based scanners?
Agent-based scanners are installed on individual hosts and can scan peers or themselves. Network-based scanners are typically remote appliances or services that probe networks from outside or centrally without residing on the target hosts.
Why isn't this a network-based scanner if it scans the network?
The classification depends on deployment. Since the scanner was installed on a victim machine (an agent), it fits the agent-based definition despite scanning network neighbors.