A housing-authority methodology write-up must distinguish discovery scanning from full vulnerability policy scans. Which distinction is correct?
Select an answer to reveal the explanation.
Short Explanation
Discovery is 'who is out there.' A full policy scan is 'check them against the big weakness checklist.' Calling them the same thing because AI ate the XML is lazy methodology writing.
Full Explanation
Housing-authority methodology write-ups must distinguish discovery scanning from full vulnerability policy scans so stakeholders understand coverage depth. Discovery scanning focuses on finding live hosts and services; deeper policy scans evaluate weaknesses with fuller plugin or policy sets. That distinction explains why a quick discovery pass can look green while residual vulnerability risk remains until policy scans complete on in-scope authority assets.
Saying discovery scans always include exploit attempts while policy scans only ping hosts misdefines both: discovery is not inherently exploitation, and policy scans are not mere pings. Claiming full vulnerability policy scans only list MAC addresses while discovery scans rate CVSS swaps outputs and invents nonsense roles for each scan type. Treating the two scan types as interchangeable labels once results enter an AI agent again confuses ingestion with methodology—AI does not collapse distinct coverage intents.
Exam caveat: methodology clarity matters in civic reporting to boards and regulators. Candidates should keep discovery versus authenticated/full policy scanning distinct even when one RAG corpus holds both result sets.
Operational check: document scan types in the housing-authority assessment plan, report coverage separately (discovered hosts vs. hosts with full policy results), and ensure AI summaries preserve scan-type labels when describing residual risk.