Exam 312-50 topic 3 question 45 discussion

All 4 answers are correct but D) "analyzing service response" is probably the most exact, as all previous answers produce some response, which vulnerability scanner have to analyze. - Vuln. scanner connects to various (or all) ports and if there is some BANNER in the response (like HTTP header "Server: Tomcat 4.1" or initial message on SSH connection like "OpenSSL ver. 5.1"), it checks the database of vulnerabilities for that SW version in the BANNER and report it (scanner usually can't test all those vulnerabilities to confirm their presence, because it can lead to service disruption, or it is just not possible via network - for example root account is needed, etc...). Scanner injects arbitrarry data as well. After all, it analyses responses.