To detect outdated software packages (installed software versions, patch levels, missing updates) on a server, the most effective methodology is credentialed scanning, because it allows the scanner to log in and inspect the system “from the inside,” including installed versions and patch status.
Exact extract (Sybex CySA+ Study Guide):
“Administrators can provide the scanner with credentials that allow the scanner to connect to the target server and retrieve configuration information… For example, if a vulnerability scan detects a potential issue that can be corrected by an operating system update, the credentialed scan can check whether the update is installed on the system before reporting a vulnerability.”
Exact extract (Secbay Press):
“With privileged credentials… the vulnerability report will be able to identify settings like these: Installed software version… Patch levels …”
Why the other options are not correct:
A (DLP) is for preventing sensitive data leakage, not detecting outdated packages.
B (Configuration management) helps maintain desired state, but the question asks specifically for a methodology to detect outdated packages—credentialed scans directly enumerate versions/patch levels.
C (CVE) is a naming/cataloging system for known vulnerabilities; it doesn’t, by itself, detect what’s installed on your server.
