Question

A CySA+ analyst reviews a monthly infrastructure scan and notices the report shows zero findings for a set of newly published critical CVEs that were disclosed three weeks ago and are known to affect the organization's web servers. The scan completed successfully with no errors, and credentialed access was confirmed. What is the MOST likely cause of the missing findings?

Accepted Answer

The scanner's plugin/vulnerability signature feed was not updated before the scan ran

Answer

The scan was configured as non-intrusive, so it could not detect the vulnerabilities

Answer

The affected web servers were excluded from the scan scope

Answer

The vulnerabilities have a low CVSS environmental score and were filtered out