Which of the following is a weakness of a vulnerability scanner?

Vulnerability scanners perform automated checks to identify known security flaws, missing patches, and misconfigurations on target systems. However, a major architectural weakness of vulnerability scanners is that they are not designed to reliably navigate through traffic-filtering devices such as packet filters, stateful firewalls, or network address translation (NAT) boundaries. When network filters block or drop probe packets, the scanner receives incomplete or misleading responses, causing inaccurate scan results, false negatives, or silent failures. Furthermore, firewalls can block specific ports, preventing the scanner from interacting with target services. Consequently, scanning across filtered network segments requires specialized configurations, local agents, or placing scanners inside target network segments behind the filtering boundaries.

Option A: Detecting known vulnerabilities is the intended core function and primary capability of a vulnerability scanner, not a weakness.
Option C: Working effectively on local networks reflects optimal deployment conditions rather than an inherent functional weakness or system limitation.
Option D: Maintaining a signature database is an essential operational mechanism used by scanners to identify security flaws, not a design weakness.

NIST Special Publication 800-115, Technical Guide to Information Security Testing and Assessment, Section 4.3 (Vulnerability Scanning Limitations), https://doi.org/10.6028/NIST.SP.800-115

ISA/IEC 62443-2-4:2018, Security for industrial automation and control systems - Program requirements for IACS service providers, Section 4.2.