Missing Data from Network Vulnerability Scans

Given a scenario, implement vulnerability scanning methods and concepts

A security analyst is performing vulnerability scans on the network. The analyst installs a scanner appliance, configures the subnets to scan, and begins the scan of the network. Which of the following would be missing from a scan performed with this configuration?

  1. Operating system version
  2. Registry key values Correct Answer
  3. Open ports
  4. IP address
Answer Correct answer: B — Registry key values are missing because the scanner appliance lacks the credentials required for authenticated internal system inspection.

Community Insight

The exam tests knowledge of scan scope limitations, specifically trapping students who assume all scanners have full host access; the common trap is failing to recognize 'scanner appliance' implies an external, non-logged-in perspective.

This question tests the difference between authenticated and unauthenticated vulnerability scanning methods. It establishes that network appliances without credentials cannot access internal OS artifacts like registry keys.

Many learners choose 'IP address' because they think the scanner doesn't know the target, but scanners identify targets via subnet configuration, making IP addresses a primary output of any scan.

Community Discussion (5 comments)

Berro_b 👍 1 Selected: B
This means the scan is Unauthenticated (Non-Credentialed). It scans systems from the network without logging into them. Unauthenticated Scan: Nessus scans a Windows computer remotely and discovers: - IP address: 192.168.1.10 - Open ports: 80, 443, 445 - Possible Windows version Authenticated Scan: Nessus logs into the Windows computer using authorized credentials and can inspect: - Windows Registry values - Installed patches - Local security configurations
Learner213 👍 1 Selected: D
A scanner should scan the entire registry considering that it has the proper credentials. I've never had to specify a registry key nonetheless a key value. I personally do not like the answer given but, if I have to pick one, I'm going with the IP address. I will usually specify an IP address or range of IP addresses when configuring/performing a scan.
deeden 👍 11 Selected: B
It would have been clearer to be if it was phrased.. what would be missing from the scan results - instead of. Anyway, I agree with B.
chaddman 👍 5
B. Registry key values A vulnerability scan performed by a scanner appliance on a network typically focuses on identifying vulnerabilities related to open ports, services, and known software vulnerabilities. It may also gather information about the operating system versions running on target hosts. However, registry key values are specific to Windows operating systems and are not typically part of a standard vulnerability scan. Registry information is typically not directly exposed or accessible via network scanning, so it's not a common target for such scans.
kmordalv 👍 14 Selected: B
Correct. Registry key values are specific to Windows operating systems and are not typically scanned directly as part of vulnerability assessments. Registry key values might contain configuration settings, but vulnerability scans usually focus on the broader picture of identifying weaknesses in software, services, and configurations rather than specific values within the Windows registry.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

The correct answer is B (Registry key values). A scanner appliance configured only with subnets performs an unauthenticated or network-based scan. From an external network perspective, the scanner can see open ports, service banners, and operating system versions (via fingerprinting), but it cannot log into the host to read sensitive internal configurations like Windows Registry keys. Accessing registry keys requires authenticated scanning, where valid credentials are provided to the scanner to allow it to query the local system.

Why the Other Options Are Wrong

A (Operating system version) is incorrect because scanners frequently use OS fingerprinting techniques (analyzing TCP/IP stack behavior or service responses) to determine the OS version without authentication. C (Open ports) is incorrect because identifying open ports is the fundamental purpose of a network vulnerability scan. D (IP address) is incorrect because the scanner knows the IP addresses from the subnet range it was configured to scan; these are the primary identifiers in the results.

Community Comment Notes

Community consensus strongly supports option B, with users noting that registry access requires specific credentials not implied by the scenario. One user explained that unauthenticated scans miss "Windows Registr..." details, while another clarified that "Registry key values are specific to Windows operating systems and are not typically scanned directly." Some dissenters argued for IP address, but this ignores that IP discovery is inherent to subnet scanning.

Exam Strategy

Always distinguish between 'Network/Unauthenticated' scans (external view: ports, services, OS guesses) and 'Authenticated' scans (internal view: patches, configs, registry, file hashes). If credentials aren't mentioned, assume the deeper internal data is missing.

Frequently Asked Questions

Can a scanner detect OS version without credentials?

Yes, through OS fingerprinting techniques analyzing network responses and service banners.

Why isn't IP address missing from the scan?

The scanner is configured with subnets, so it actively probes and discovers the IP addresses within those ranges.

More CS0-003 FAQ →

Related Analysis

An employee is suspected of misusing a company-issued laptop

A-Grade

An organization was compromised, and the usernames and passw

A-Grade

Which of the following actions would an analyst most likely

A-Grade

← Back to CS0-003 Study Guide