A vulnerability scan shows the utilities portal as exploitable. The analyst still needs to know who logged in last night. What role do the scanner results play?
Select an answer to reveal the explanation.
Short Explanation
A pothole report is not a list of who drove the road. Scanner output says the utilities portal was weak; last night's logons still live in authentication logs.
Full Explanation
Vulnerability scanner results on the utilities portal provide context about what was exploitable—CVEs, severity, and affected services—but they do not substitute for authentication logs when the analyst needs to know who logged in last night. Exploitability is predisposing condition; login evidence is identity telemetry. Civic investigations must keep those roles separate so scanner findings enrich urgency without pretending to be session proof.
Treating scanner results as login evidence so authentication logs can be skipped fails by equating vulnerability with access. Replacing Asset and Identity lookups for every civic user with scanner output fails by role—scanners inventory weaknesses, not HR/identity ownership maps. Claiming a CVE on the host proves the login succeeded confuses possibility with evidence of authentication.
Exam caveat: vuln context ≠ authentication proof; exam stems often pair "exploitable" with "who logged in" to test this split.
Operational check: keep scanner findings as notable enrichment and priority context; query Authentication (portal SSO, VPN, or app logs) for last night's utilities-portal logons; join users via Asset and Identity separately from CVE lists.