Vulnerability Scan False Positive Identification

SY0-701 By islever Editorial Last updated

Explain various activities associated with vulnerability management.

Short answer

A A false positive describes a vulnerability scan incorrectly identifying a vulnerability that is not actually present on the scanned system.

Question

After conducting a vulnerability scan, a systems administrator notices that one of the identified vulnerabilities is not present on the systems that were scanned. Which of the following describes this example?
  1. False positive Correct Answer
  2. False negative
  3. True positive
  4. True negative

Key Takeaways

This question tests the classification of vulnerability scan results, where the common trap is misreading 'identified' as meaning the vulnerability exists, rather than recognizing it means the scanner flagged it.

A vulnerability scan that reports a vulnerability which does not actually exist on the target system is a false positive. This page establishes why this specific scenario represents a false positive rather than a false negative.

Common mistake: Choosing False negative (B) due to misinterpreting 'identified vulnerabilities' as vulnerabilities known to exist but missed by the scanner, rather than vulnerabilities flagged by the scanner.

Expert Analysis

Why the Answer Is Correct

A false positive occurs when a vulnerability scanner incorrectly flags a system as having a vulnerability that is not actually present. In this scenario, the scan "identified" (reported) a vulnerability, but the administrator discovered it was "not present" in reality. Because the scanner's positive identification was factually incorrect, this is definitively a false positive.

Why the Other Options Are Wrong

A false negative occurs when a vulnerability genuinely exists on a system but the scanner fails to detect or report it. A true positive means the scanner correctly identified a real vulnerability, while a true negative means the scanner correctly reported that a vulnerability does not exist. None of these match the scenario of a scanner reporting a non-existent vulnerability.

Community Comment Notes

There is significant confusion in the community comments between false positives and false negatives. Some users mistakenly argue for false negative, such as one who claimed "A known vulnerability has been found but the scanner failed to see it," which reverses the question's wording. As user test_arrow correctly pointed out, "the vulnerability was NOT present after the scan indicates a false positive," because the scanner's alert was the false part, and its identification was the positive part.

Official Reference

https://csrc.nist.gov/publications/detail/sp/800-115/final

This link opens the official vendor documentation in a new tab.

Exam Strategy

When evaluating scan accuracy terminology, focus strictly on the scanner's action first: if the scanner flagged it, it is a 'positive' result. Then evaluate reality: if the flag is wrong, it is 'false'. Combining these two steps gives the correct classification.

Community Votes

A
50%
B
50%

50% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. test_arrow 👍 4 Answered A
    the vulnerability was NOT present after the scan indicates a false positive
  2. TmNvrWts 👍 3 Answered A
    The correct answer is: A. False positive Explanation: A false positive occurs when a security system incorrectly flags a vulnerability or threat that does not actually exist on the system. In this case, the vulnerability scan reported an issue, but upon further investigation, the administrator confirmed that the vulnerability is not present. Why not the other options? B. False negative – This would mean a vulnerability is present but was not detected, which is the opposite of what happened here. C. True positive – This would mean the vulnerability was correctly identified and is actually present on the system. D. True negative – This would mean the system was correctly identified as not having the vulnerability, but in this case, the scan incorrectly reported it.
  3. rrynzon 👍 3
    False Positive - Normal or expected activity is incorrectly identified as abnormal or unexpected. False Negative - Abnormal or unexpected activity is incorrectly identified as normal or expected. Therefore, B is the correct answer.
  4. tomahawk117 👍 2 Answered B
    This one is a false negative. Why? A known vulnerability has been found but the scanner failed to see it. False Positive means the scanner incorrectly identified a vulnerability
  5. ijia_Ai0823 👍 2 Answered B
    B. False negative. Because it is an "identified" vulnerabilities but not reported by a scan.
Show 3 more comments
  1. jafyyy 👍 2
    A. False Positive - an alert for an event that is not a threat.
  2. SAM0678 👍 3 Answered B
    Its a false negative
  3. qacollin 👍 1 Answered A
    A. GPT

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide