A security analyst conducts a manual scan on a known hardened host that identifies many non-compliant configuration items.
Which of the following BEST describe why this has occurred? (Choose two.)
Click on the arrows to vote for the correct answer
A. B. C. D. E.BD.
Based on the given scenario, there are several reasons why a manual scan on a known hardened host identified many non-compliant configuration items. Two possible explanations are:
A. Privileged-user credentials were used to scan the host: A security analyst with privileged user credentials can perform a more in-depth scan of a system. However, if the scan is not conducted properly, it could identify non-compliant configuration items that are not actually a risk to the system. For instance, the scan may identify default settings that have been intentionally left unchanged by the system administrator because they are not a security risk. Therefore, using privileged user credentials to scan a system can result in false positives, which are items identified as vulnerabilities that are not actually a risk.
B. Non-applicable plugins were selected in the scan policy: When a security analyst performs a scan, they can select specific plugins to be used in the scan. These plugins are designed to identify specific types of vulnerabilities or configuration issues. However, if the security analyst selects plugins that are not applicable to the system being scanned, it can result in false positives. For example, if a plugin designed to identify a vulnerability in a Windows system is used to scan a Linux system, it may produce false positives because the vulnerability does not exist on the Linux system.
Therefore, in the given scenario, the most likely reasons for the identification of many non-compliant configuration items are the use of privileged user credentials or the selection of non-applicable plugins in the scan policy. However, it's important to note that the incorrect audit file or false positives in the report could also be contributing factors, but these options are less likely. Additionally, the possibility of the target host being compromised cannot be entirely ruled out, but it is not a probable cause based on the information provided.