Question

A cloud security operations team runs weekly vulnerability scans against a fleet of IaaS Linux instances. The unauthenticated network scans consistently report far fewer findings than expected, and patching teams complain the reports miss known missing OS patches confirmed by their own package inventory. The SOC lead wants scan results that accurately reflect installed software versions and missing patches on each host. Which change to the scanning approach BEST addresses this gap?

Accepted Answer

Configure authenticated (credentialed) scans using per-host service accounts so the scanner can query installed packages and patch levels directly

Answer

Increase the network scan frequency from weekly to daily to capture more transient vulnerabilities

Answer

Open additional firewall ports between the scanner and the instances to allow deeper port probing

Answer

Switch to an external attacker-perspective scan from outside the cloud VPC to validate real-world exposure