An analyst must verify whether a Windows server is missing Microsoft security updates and whether local audit policy settings are configured correctly. The scan must check installed patches and registry settings without relying on network services. Which vulnerability scanning method should be used?

An authenticated Windows host scan uses valid local or domain credentials so the scanner can query the operating system directly: installed update packages, hotfixes, registry keys, audit policies, and service configurations. This is the method of choice when patch status and local settings must be verified inside the host, because many missing updates and policy deviations are not reliably visible through network probes. An unauthenticated network service scan only observes externally reachable services, banners, and protocol responses, so it cannot enumerate installed Microsoft updates or local audit policy. A web application dynamic scan exercises HTTP endpoints and client-side flows, which is useful for application-layer defects but irrelevant to host patch inventory. A cloud image or agentless cloud snapshot scan evaluates templates or offline images for misconfigurations, but it does not prove the running Windows server's current patch state unless the scan is explicitly credentialed against that host. Exam caveat: choose the scanning method based on the evidence source required, not simply the asset's location or network reachability. Operational check: before running the scan, confirm the service account has least-privilege read access to update and policy registries and that scan scheduling avoids locking or rebooting critical systems.