Missing Data from Network Vulnerability Scans
Short answer
B Registry key values are missing because the scanner appliance lacks the credentials required for authenticated internal system inspection.
Question
Key Takeaways
The exam tests knowledge of scan scope limitations, specifically trapping students who assume all scanners have full host access; the common trap is failing to recognize 'scanner appliance' implies an external, non-logged-in perspective.
This question tests the difference between authenticated and unauthenticated vulnerability scanning methods. It establishes that network appliances without credentials cannot access internal OS artifacts like registry keys.
Common mistake: Many learners choose 'IP address' because they think the scanner doesn't know the target, but scanners identify targets via subnet configuration, making IP addresses a primary output of any scan.
Expert Analysis
Why the Answer Is Correct
The correct answer is B (Registry key values). A scanner appliance configured only with subnets performs an unauthenticated or network-based scan. From an external network perspective, the scanner can see open ports, service banners, and operating system versions (via fingerprinting), but it cannot log into the host to read sensitive internal configurations like Windows Registry keys. Accessing registry keys requires authenticated scanning, where valid credentials are provided to the scanner to allow it to query the local system.
Why the Other Options Are Wrong
A (Operating system version) is incorrect because scanners frequently use OS fingerprinting techniques (analyzing TCP/IP stack behavior or service responses) to determine the OS version without authentication. C (Open ports) is incorrect because identifying open ports is the fundamental purpose of a network vulnerability scan. D (IP address) is incorrect because the scanner knows the IP addresses from the subnet range it was configured to scan; these are the primary identifiers in the results.
Community Comment Notes
Community consensus strongly supports option B, with users noting that registry access requires specific credentials not implied by the scenario. One user explained that unauthenticated scans miss "Windows Registr..." details, while another clarified that "Registry key values are specific to Windows operating systems and are not typically scanned directly." Some dissenters argued for IP address, but this ignores that IP discovery is inherent to subnet scanning.
Exam Strategy
Always distinguish between 'Network/Unauthenticated' scans (external view: ports, services, OS guesses) and 'Authenticated' scans (internal view: patches, configs, registry, file hashes). If credentials aren't mentioned, assume the deeper internal data is missing.
Frequently Asked Questions
Can a scanner detect OS version without credentials?
Why isn't IP address missing from the scan?
Discussion 5 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 5
-
kmordalv 👍 14 Answered BCorrect. Registry key values are specific to Windows operating systems and are not typically scanned directly as part of vulnerability assessments. Registry key values might contain configuration settings, but vulnerability scans usually focus on the broader picture of identifying weaknesses in software, services, and configurations rather than specific values within the Windows registry.
-
deeden 👍 11 Answered BIt would have been clearer to be if it was phrased.. what would be missing from the scan results - instead of. Anyway, I agree with B.
-
chaddman 👍 5B. Registry key values A vulnerability scan performed by a scanner appliance on a network typically focuses on identifying vulnerabilities related to open ports, services, and known software vulnerabilities. It may also gather information about the operating system versions running on target hosts. However, registry key values are specific to Windows operating systems and are not typically part of a standard vulnerability scan. Registry information is typically not directly exposed or accessible via network scanning, so it's not a common target for such scans.
-
Berro_b 👍 1 Answered BThis means the scan is Unauthenticated (Non-Credentialed). It scans systems from the network without logging into them. Unauthenticated Scan: Nessus scans a Windows computer remotely and discovers: - IP address: 192.168.1.10 - Open ports: 80, 443, 445 - Possible Windows version Authenticated Scan: Nessus logs into the Windows computer using authorized credentials and can inspect: - Windows Registry values - Installed patches - Local security configurations
-
Learner213 👍 1 Answered DA scanner should scan the entire registry considering that it has the proper credentials. I've never had to specify a registry key nonetheless a key value. I personally do not like the answer given but, if I have to pick one, I'm going with the IP address. I will usually specify an IP address or range of IP addresses when configuring/performing a scan.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.