Question

which of these may be considered the worst practice when it comes to vulnerability scans? a scanning production servers b notifying operations staff ahead of time c taking no action on the results d using limited details in your scan reports

Explanation:

Vulnerability scans are meant to identify security - risks. If no action is taken on the results, the purpose of the scan is defeated. Scanning production servers can be done carefully, notifying staff is a good practice, and limited details in reports may be a matter of policy or necessity in some cases. But ignoring results is a major flaw.

Answer:

C. Taking no action on the results