Skip to tutorial content
Rate module Not yet rated

Choosing the Discovery Method for Each Zone

4 min read
On this page

In this lesson, you will learn:

  • How to match each zone to a method
  • Why the Finance zone uses agents
  • Where Nmap credential-less fits

🔁 Quick look back: Last time: Designing the MID Server Architecture. You learned how SNWR chose where its MID Servers go.

1 The Problem: The Finance Zone Blocks Inbound Scans

Most SNWR zones can be scanned from a MID Server. The Finance zone can’t:

  • It blocks all inbound connections.
  • Farah won’t make an exception.

🎯 The problem: The Finance zone blocks the normal way of scanning.

👉 The fix: Choose a method per zone. For Finance, use agents that connect out.

Table of zones and chosen method.
Figure 1. The discovery method for each SNWR zone (DD-D02).

2 Matching zones to methods

  1. Can a MID Server reach it and log in? Use IP-based Discovery.
  2. Is it a cloud account? Use Cloud Discovery.
  3. Does it block inbound connections? Use ACC agents.
  4. Is it unknown with no credential? Nmap credential-less, as a fallback only.

⚠️ Limits: Nmap credential-less Discovery needs a Windows MID Server with Nmap, and it isn’t allowed for cloud targets.

3 Writing the decision

Record the method, the reason, and what the zone owner agreed. For Finance, Farah must approve the agent approach.

4 Project Clear View: How We Implemented It

📍 Situation: Farah won’t allow inbound scans into Finance.

🧭 Decision: Use ACC agents for Finance, and write down each zone’s method.

🛠️ Steps we took:

  1. Went through each zone with its owner.
  2. Chose agents for Finance, with one outbound port to the Mumbai MID cluster.
  3. Allowed Nmap only in SNWR Network Sweep, on the Mumbai Windows MID Servers.
  4. Wrote DD-D02.

✅ What we verified:

  • Farah approved the agent approach.
  • Every zone has one main method.

📁 Evidence: DD-D02 in the design document.

5 Quick recap

  • Pick one main method per zone.
  • IP-based for reachable zones, cloud for cloud accounts.
  • Agents for zones that block inbound traffic.
  • Nmap credential-less is a fallback only.

6 Check yourself

Think of your answer first. Then tap to check.

1 Which method did SNWR choose for Finance? Show answer

ACC agents.

2 Where does Nmap credential-less Discovery run at SNWR? Show answer

Only in SNWR Network Sweep, on the Mumbai Windows MID Servers.

3 Can Nmap credential-less scan AWS? Show answer

No. It isn’t allowed for cloud targets.

Nice work! Every SNWR zone has a method. 🎉
Next up: Designing the Credential Strategy

Was this lesson helpful?

Have a question or doubt?

Ask here and get help from instructors and fellow learners.

0 / 300

Only logged-in learners can post.