ISC2 Governance, Risk and Compliance (CGRC) Practice Question

Providing the scanner with read-only privileged credentials is the most effective way to improve scan accuracy and reduce false positives. With valid credentials, the scanner can log into each host, enumerate installed patches, and directly compare software versions with current vulnerability data-avoiding the guesswork and banner-based assumptions that often lead to misidentified findings.

Running the scan during peak production hours can introduce performance issues and noisy results. Temporarily disabling host-based intrusion-prevention or firewall services may prevent them from blocking probes, but it also increases risk and is unnecessary if the scanner's address can simply be whitelisted; moreover, it does not by itself address false positives caused by lack of internal visibility. Restricting the scan to a limited default port list reduces coverage and can miss services on non-standard ports, increasing the chance of undiscovered vulnerabilities.