Question

During an internal engagement, you run both an unauthenticated and a credentialed OpenVAS scan against the same Windows workstation. The unauthenticated scan reports a critical remote code execution vulnerability in an outdated version of a service, but the credentialed scan does not list that finding at all. Local patch records confirm the relevant update was installed last month. Which conclusion best explains the discrepancy, and what should you do?

Accepted Answer

The unauthenticated finding is likely a false positive based on a stale service banner; correlate with the patch-level data from the credentialed scan and manually verify before reporting.

Answer

The credentialed scan missed the vulnerability due to insufficient privileges; report the critical RCE from the unauthenticated scan as confirmed.

Answer

Both results are valid; report the vulnerability twice, once as critical and once as informational, to reflect each scan perspective.

Answer

The patch records are unreliable; escalate to the client immediately and recommend re-imaging the workstation before continuing testing.