Network-based plus credentialed scans verify an outdated web-server finding with least effort
Short answer
AE A network-based scan fingerprints the exposed web service and a credentialed scan reads installed package versions, verifying the finding cheaply.
Question
Key Takeaways
To validate a version-detection finding, look from outside with a network scan that fingerprints the service banner and from inside with a credentialed scan that reads the actually installed package versions.
Passive scanning in the transit VPC flagged outdated web-server software on a public subnet host. An active network-based scan against the service and a credentialed scan of the host together confirm the true version and installed packages with the least additional effort and cost.
Common mistake: A red-team exercise (D) would eventually confirm the finding but at prohibitive cost and effort, which the question explicitly rules out.
Expert Analysis
Why the Answer Is Correct
A network-based scan actively probes the web service on the public subnet and reads its version fingerprint directly, confirming or refuting what the passive pass inferred without installing anything. A credentialed scan logs into the host with an agent-less account and enumerates the actually installed package versions and patch state, which is authoritative for whether the software is outdated. Both reuse existing scanning infrastructure, so together they deliver definitive verification at the least additional cost and effort.
Why the Other Options Are Wrong
B, an agent-based scan, does provide deep host detail but requires deploying and maintaining agents on the target, which is exactly the added effort the question says to avoid. C, a port scan, only maps open ports and cannot read software versions, so it cannot confirm an outdated-software finding. D, a red-team exercise, is a full adversarial engagement priced far above a confirmation task and is grossly disproportionate here.
Community Comment Notes
Joshuac1392, the top-liked comment, endorses the provided AE pairing even while noting other tools disagree. BigM explains that a network-based scan identifies vulnerable services without agent installation and a credentialed scan verifies installed software, both low-cost follow-ups. WereAllinThisTogether pushes B over A on the layer-4 objection, but version fingerprinting of an HTTP service is standard layer-7 network scanning, and agent deployment still costs more effort than the question allows.
Official Reference
https://csrc.nist.gov/pubs/sp/800/115/final
This link opens the official vendor documentation in a new tab.
Community Votes
100% of anonymous learners picked answer AE. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
Joshuac1392 👍 5Even though ChatGPT says otherwise, i agree with the answers provided
-
BigM 👍 1Explanation: To verify whether the vulnerability detected in the public subnet is a true positive, the company needs to perform a follow-up scan with the least effort and cost. ✔ A. A network-based scan – This is a passive or active scan that inspects network traffic and identifies vulnerable services without requiring agent installation. It is a low-cost and efficient method for verifying web server vulnerabilities. ✔ E. A credentialed scan – This scan logs into the web server using administrator credentials to check for vulnerabilities in installed software more accurately than an uncredentialed scan. It helps confirm outdated software versions and misconfigurations without false positives.
-
WereAllinThisTogether 👍 1E and B. If this pertains to software being vulnerable then a network scan will do nothing. Network based scans work at layer 4 of the OSI model and cannot detect application layer vulnerabilities. An agent such as; Tenable, Nexxus, Cisco Posturing module, SecureConnector can provide a in-depth scan of the software. D, ACAS and other scanning mechanisms can help facilitate information about the software through a credentialed scans. I find this very surprising and somewhat concerning no one knows this answer.
-
FrancisDrake 👍 1Least effort. Least cost.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.