A transit purple team compares approaches for a bus-yard lab assessment. Which statement correctly contrasts passive and active enumeration?
Select an answer to reveal the explanation.
Short Explanation
Passive is eavesdropping on what is already talking. Active is knocking on doors to see who answers. An AI write-up does not make those two methods the same thing.
Full Explanation
In a transit purple-team bus-yard lab, passive and active enumeration are complementary methods with different network footprints. Passive traffic enumeration observes existing flows—often via taps, SPAN, or NetFlow-like telemetry—with less active probing, while active port scanning generates probe traffic to map open services. That contrast matters for yards that may include fragile vehicle systems, maintenance Wi-Fi, or segmented OT-adjacent gear where probe volume must be controlled.
Saying passive enumeration always requires credentialed vulnerability plugins while active scanning never touches the network reverses both ideas: passive observation is not credentialed vuln scanning, and active scanning by definition injects traffic. Claiming active scanning only reads NetFlow archives while passive methods always send SYN floods swaps the methods and misstates aggressiveness. Declaring passive and active enumeration identical once an AI agent writes the final report confuses documentation with methodology—an AI narrative does not erase probe versus observe differences.
Exam caveat: AI reporting layers frequently tempt candidates to treat methods as interchangeable. Assessors still need to know whether evidence came from observation or active probes for ROE, safety, and residual-risk statements.
Operational check: label each bus-yard inventory artifact as passive or active, document probe rates and targets for active scans in ROE, and ensure AI summaries preserve method provenance so transit stakeholders can judge impact and coverage.