A security team is selecting between authenticated and unauthenticated vulnerability scans for a quarterly assessment of internal servers. Which scenario BEST justifies using an authenticated scan?

C is correct because authenticated scans log into target systems and enumerate installed software versions, patch levels, registry settings, and local configurations that are invisible to unauthenticated scans. This provides a significantly more accurate vulnerability inventory for internal systems. A is wrong because simulating an external attacker is the purpose of an unauthenticated scan. B is wrong because external scans from the internet are inherently unauthenticated unless credentials are passed over the internet, which is not recommended. D is wrong because authenticated scans are generally heavier on target resources since they perform deep local enumeration.