Which option best describes a vulnerability scan that intentionally uses credentials to access more information and find deeper issues?

Which option best describes a vulnerability scan that intentionally uses credentials to access more information and find deeper issues?

• A. Non-credentialed scan
• B. Automated audit
• C. Credentialed scan
• D. Manual review

Answer: (C)

Credentialed vulnerability scanning uses valid user credentials to authenticate to systems, allowing the scanner to see inside the environment rather than just what’s exposed publicly. With this access, it can inspect installed software, patch levels, misconfigurations, file permissions, and running services to uncover deeper issues that unauthenticated tests miss. This approach generally yields more accurate results and fewer false positives because it mirrors the actual state and controls of the system. It goes beyond a non-credentialed scan, which only gathers information available without authentication, and this distinction is what makes it the best description for finding deeper vulnerabilities. Manual review is human-driven and not an automated credential-based scan, while automated audit is a broader term that doesn’t specifically imply using credentials to broaden visibility.

Credentialed vulnerability scanning uses valid user credentials to authenticate to systems, allowing the scanner to see inside the environment rather than just what’s exposed publicly. With this access, it can inspect installed software, patch levels, misconfigurations, file permissions, and running services to uncover deeper issues that unauthenticated tests miss. This approach generally yields more accurate results and fewer false positives because it mirrors the actual state and controls of the system. It goes beyond a non-credentialed scan, which only gathers information available without authentication, and this distinction is what makes it the best description for finding deeper vulnerabilities. Manual review is human-driven and not an automated credential-based scan, while automated audit is a broader term that doesn’t specifically imply using credentials to broaden visibility.