Agent-Based vs Network-Based Vulnerability Scanners

312-50v13 By islever Editorial Last updated

Vulnerability Analysis

Short answer

A An agent-based scanner is employed because the tool was installed on a single machine to scan other devices on the network.

Question

John, a disgruntled ex-employee of an organization, contacted a professional hacker to exploit the organization. In the attack process, the professional hacker installed a scanner on a machine belonging to one of the victims and scanned several machines on the same network to identify vulnerabilities to perform further exploitation. What is the type of vulnerability assessment tool employed by John in the above scenario?
  1. Agent-based scanner Correct Answer
  2. Network-based scanner
  3. Cluster scanner
  4. Proxy scanner

Key Takeaways

The key trap is confusing the tool's ability to scan multiple machines with its deployment model; network-based scanners typically target the infrastructure itself, whereas agent-based scanners reside on a host to coordinate local and peer scanning.

This question distinguishes between agent-based and network-based vulnerability assessment tools based on installation location and scanning scope. It establishes that installing a scanner on a single host to scan peers defines an agent-based approach.

Common mistake: Many learners select 'Network-based scanner' because the action involves scanning a network, overlooking the critical detail that the scanner software was installed on a specific victim machine rather than being a dedicated network appliance or remote probe.

Expert Analysis

Why the Answer Is Correct

The correct answer is A (Agent-based scanner). In the scenario, the hacker installs the scanner software directly onto a compromised machine within the target environment. According to standard ethical hacking frameworks (such as EC-Council curriculum), an agent-based scanner resides on a single machine but can be configured to scan other machines on the same network. The defining characteristic here is the installation of the scanner on a host, which then acts as an agent for further reconnaissance.

Why the Other Options Are Wrong

Option B (Network-based scanner) is incorrect because network-based scanners are typically standalone appliances or remote services that monitor network traffic or probe devices from an external or centralized point without necessarily residing on a compromised host as an active agent. Option C (Cluster scanner) refers to distributed scanning across multiple nodes, not a single-host install. Option D (Proxy scanner) involves routing requests through a proxy server, which is unrelated to the described installation method.

Community Comment Notes

While the community vote was split, several users correctly identified Option A by citing the specific definition that agent-based scanners "reside on a single machine but can scan several machines on the same network." One commenter noted this aligns with Module 5 page 561 of the study guide. Others argued for B, mistakenly focusing on the "network scanning" action rather than the "installed on a machine" constraint. The distinction lies in the deployment: if it's installed on the host, it's an agent.

Exam Strategy

When analyzing vulnerability scanner types, always look at where the software is deployed first. If it is installed on a specific endpoint/host, it is likely Agent-based. If it scans from a central location or monitors traffic flows without residing on the scanned hosts, it is Network-based.

Frequently Asked Questions

What is the difference between agent-based and network-based scanners?

Agent-based scanners are installed on individual hosts and can scan peers or themselves. Network-based scanners are typically remote appliances or services that probe networks from outside or centrally without residing on the target hosts.

Why isn't this a network-based scanner if it scans the network?

The classification depends on deployment. Since the scanner was installed on a victim machine (an agent), it fits the agent-based definition despite scanning network neighbors.

More 312-50v13 FAQ →

Community Votes

B
56%
A
44%

56% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. Booict 👍 2 Answered B
    he attacker installed a scanner on one machine and used it to scan other machines on the network. This aligns more closely with the behavior of a network-based scanner, which is designed to scan multiple devices on a network from a central point
  2. Poornima023 👍 2 Answered A
    Agent-based scanners reside on a single machine but can scan several devices on the same network.
  3. getaseadsss 👍 2 Answered B
    Attacker is clearly using network scanning
  4. killwitch 👍 1 Answered B
    B. Network-based scanner. A network-based scanner is a tool that scans multiple machines within a network to identify vulnerabilities. It operates by probing network devices, servers, and workstations to detect weaknesses such as open ports, misconfigurations, and outdated software that can be exploited. In this scenario: 1. A scanner is installed on a machine within the organization’s network. 2. It scans several machines on the same network to find vulnerabilities. 3. The attacker uses this information for further exploitation. Why not the others: A. Agent-based scanner – Requires agents installed on each device for vulnerability scanning. The scenario does not mention this. C. Cluster scanner – Typically used for scanning clusters of servers or cloud environments, which is not specified here. D. Proxy scanner – Used for anonymizing scans and routing traffic through proxies, not for internal network scanning.
  5. LeonardoLira 👍 1 Answered A
    No cenário descrito, o hacker instalou o scanner em uma máquina comprometida e a usou para escanear outras máquinas na rede. Isso corresponde exatamente ao funcionamento de um agent-based scanner, que coleta informações sobre múltiplos dispositivos a partir de um único ponto. Não pode ser o um network-based scanner interage apenas com a máquina onde está instalado e gera o relatório nela mesma. Pagina 337 material oficila da EC COUNCIL
Show 1 more comment
  1. Rangnarok 👍 1 Answered A
    Module 5 - page 561 Agent-Based Scanner: Agent-based scanners reside on a single machine but can scan several machines on the same network.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Network Sniffing Techniques for Penetration Testing

S-grade

File-less Malware Bypassing Application Whitelisting

S-grade

SQL Injection Bypass in Login Forms

S-grade

Session Donation vs. Session Fixation Attack

S-grade

← Back to 312-50v13 Study Guide