Quarterly authenticated scanning of the county property-appraisal system reports missing OS and application patches. What is the primary security-assessment purpose of that activity?
Select an answer to reveal the explanation.
Short Explanation
Think of authenticated scans as a flashlight with a key—they see missing patches from the inside. The point is finding weaknesses so leaders can fix them, not rewriting policy, skipping baselines, or claiming risk is gone.
Full Explanation
Authenticated vulnerability scanning of the county property-appraisal system is a control-testing technique: credentials give the scanner host-level visibility so it can identify known weaknesses such as missing OS and application patches. The primary security-assessment purpose is discovery that feeds risk-based remediation prioritization by management—not proof that policy documents were rewritten, not a substitute for every other baseline check, and not a marketing claim that residual risk is zero. Credentialed results are higher-fidelity than unauthenticated scans because they see installed packages, configuration state, and missing updates that external probes often miss, giving the county a realistic inventory of exposures against which to schedule patch windows and compensating controls.
Rewriting change-management policy does not prove patches were applied; policy is directive, while scanning is evidentiary discovery of current state. Authenticated scans also do not replace configuration baselines or compliance checks—those activities answer different questions about desired hardened state versus known vulnerability signatures. Using scan output to generate marketing metrics that assert zero residual risk misuses assessment data: scans are point-in-time, signature-dependent, and silent on unknown flaws, exploitability in context, and business impact.
Exam caveat: Domain 6 distinguishes vulnerability assessment (find known weaknesses) from penetration testing (attempt exploitation). Authenticated scanning is VA/control testing. Do not confuse ‘identify weaknesses for prioritization’ with ‘prove full remediation’ or ‘eliminate residual risk.’
Operational check: After each quarterly scan, triage by exploitability and asset criticality for appraisal data, assign owners and due dates, track patch latency as a KRI, and reconcile scan findings against the change calendar so false ‘missing patch’ noise from pending approved windows is filtered before escalation to county leadership.