A county security team is defining vulnerability scan coverage for an internet-facing tax portal and a private admin VPC. What scanning approach fits the environments?
Select an answer to reveal the explanation.
Short Explanation
Public storefront and locked back office need different flashlight beams. The tax portal gets external-facing scan scope; the admin VPC gets careful internal scans—not one blunt scan from the open internet for both.
Full Explanation
Vulnerability scan coverage should match exposure and trust boundaries. An internet-facing tax portal warrants broader external checks that reflect what attackers on the open internet can see, while a private admin VPC needs tightly controlled internal (often authenticated) scans that do not recklessly attack management planes from untrusted paths. Scoping scans differently protects both citizen services and privileged county admin networks.
Scanning only the admin VPC because public portals are "protected by DNS alone" ignores the highest exposure asset. Using identical aggressive authenticated scans from the open internet against both the portal and every admin host can be unsafe, noisy, and architecturally wrong for private admin segments. Skipping portal scans after go-live leaves continuous risk unidentified.
Exam caveat: external vs internal scanning, authenticated vs unauthenticated, and scope based on inventory are distinct exam themes. Never assume DNS or obscurity replaces scanning.
Operational check: maintain asset inventory for portal and admin VPC, configure separate scan profiles and source IPs appropriate to each, schedule recurring scans, and feed findings into the county vuln program with clear owners. Validate that scanners can reach intended targets without bypassing jump-host controls improperly.