Agent-based vulnerability scanners miss several city-issued laptops that are powered off during the scan window. What does this illustrate about scan scope?
Select an answer to reveal the explanation.
Short Explanation
If the census taker only knocks when you are at work, half the block never gets counted. Offline laptops show why discovery method and scope matter—missed assets mean missed vulns.
Full Explanation
Scan results are only as complete as asset discovery and collection methods allow. Agent-based scanners that miss city-issued laptops powered off during the scan window illustrate that scope and inventory must account for intermittently offline endpoints—or identification will under-report risk on devices that later reconnect to administer or access civic systems.
Offline laptops are not automatically compliant forever. Limiting the program to only always-on cloud VMs ignores endpoints that handle municipal data. Agents do not replace the need for an authoritative asset inventory and complementary scan methods.
Exam caveat: agent-based vs network/agentless scanning have different coverage gaps (offline hosts vs credentialed depth). Exams expect recognition that incomplete inventory yields incomplete vuln management.
Operational check: reconcile agent check-ins to the laptop inventory, alert on missing agents, use complementary scans at VPN reconnect or disk encryption escrow joins, and schedule catch-up assessments for chronically offline devices. Report coverage percentage monthly to city IT leadership.
Treat agent coverage as an SLA for the laptop fleet: publish the percentage of city-issued endpoints that checked in within the scan window, and escalate chronically offline privileged devices that administer cloud consoles.