A security team is selecting between authenticated and unauthenticated vulnerability scans for a quarterly assessment of internal servers. Which scenario BEST justifies using an authenticated scan?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you use an authenticated scan when you need to log in and see missing patches, insecure configs, and other OS-level issues that an unauthenticated scan can't see. It gives you a much more accurate vulnerability inventory for internal systems.
Full Explanation
The scenario needing a comprehensive view of vulnerabilities including missing patches and insecure configurations detectable only with OS-level access is correct. Authenticated scans log into target systems and enumerate installed software versions, patch levels, registry settings, and local configurations invisible to unauthenticated scans, giving a more accurate vulnerability inventory for internal systems. The scenario simulating an unauthenticated external attacker with no prior knowledge or access is wrong because that is the purpose of an unauthenticated scan. The scenario scanning external-facing public systems from the internet perspective is wrong because internet scans are inherently unauthenticated unless credentials are passed over the internet, which is not recommended. The scenario minimizing scan resource impact on production systems during business hours is wrong because authenticated scans are generally heavier on target resources due to deep local enumeration.