A DBA team manages forty database servers across on-premises and cloud environments. Management wants a repeatable way to identify known weaknesses such as missing security patches, insecure default settings, and outdated components on every server. Which practice meets this requirement?
Select an answer to reveal the explanation.
Short Explanation
A vulnerability scanner is like a home inspector with a checklist of every known defect; it walks each house and tells you what's missing or misconfigured. Credentialed scans see more, because the inspector gets inside. Integrity checks and log reviews are good habits, but they're answering different questions.
Full Explanation
Vulnerability scanning is the attack surface management practice that compares systems against databases of known vulnerabilities and insecure configurations. Scheduled scans across every host make the process repeatable, and authenticated (credentialed) scans log into the operating system or database to read installed versions, patch levels and configuration settings, which finds far more than an unauthenticated network scan. Tracking findings over time feeds patching and remediation. Database integrity checks verify the physical and logical consistency of data structures, catching corruption, but they do not evaluate patch levels or insecure defaults. Reviewing failed-login entries is security monitoring: it can reveal attacks in progress, but it finds attempts rather than the weaknesses those attempts might exploit, and it says nothing about missing patches. Comparing performance counters to a baseline detects resource anomalies, which can hint at problems, but it is not a method for discovering known vulnerabilities. Exam caveat: scanning identifies weaknesses, patching fixes them, and remediation includes any configuration changes and verification afterward. Operational check: confirm every one of the forty hosts appears in the scanner's scope with a successful authenticated scan, and review the latest report for critical findings.