A SOC analyst must run a credentialed vulnerability scan against a sensitive production service that cannot tolerate performance degradation during business hours. How should the scan be scheduled?

Credentialed scanning logs in to the target to read patch levels, installed software and configuration, which produces far more accurate results than an unauthenticated probe but also generates real load and can trigger locking, logging bursts or service instability on fragile systems. When a service cannot tolerate degradation during business hours, the scan belongs in an approved maintenance window, when change control has accepted the risk, users are off the system and support staff are ready to roll back. Running unauthenticated scans at peak hours both violates the stated constraint and returns weaker findings. Continuous passive traffic analysis is a useful supplement for fragile or operational technology systems, but it does not satisfy a requirement to perform a credentialed scan. Launching credentialed scans immediately after each change request ignores timing altogether and could hit production during the busiest hours. On the exam, read the constraint words carefully: a mandated scan type plus a no-degradation window points to scheduling, not to swapping the method. Operationally, coordinate the window with the service owner, throttle scan concurrency, exclude known fragile checks, and confirm health metrics before and after the scan.