Vulnerability Scan False Positive Identification

Explain various activities associated with vulnerability management.

After conducting a vulnerability scan, a systems administrator notices that one of the identified vulnerabilities is not present on the systems that were scanned. Which of the following describes this example?

  1. False positive Correct Answer
  2. False negative
  3. True positive
  4. True negative
Answer Correct answer: A — A false positive describes a vulnerability scan incorrectly identifying a vulnerability that is not actually present on the scanned system.

Community Votes

A
50%
B
50%

50% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests the classification of vulnerability scan results, where the common trap is misreading 'identified' as meaning the vulnerability exists, rather than recognizing it means the scanner flagged it.

A vulnerability scan that reports a vulnerability which does not actually exist on the target system is a false positive. This page establishes why this specific scenario represents a false positive rather than a false negative.

Choosing False negative (B) due to misinterpreting 'identified vulnerabilities' as vulnerabilities known to exist but missed by the scanner, rather than vulnerabilities flagged by the scanner.

Community Discussion (9 comments)

SAM0678 👍 3 Selected: B
Its a false negative
mejestique 👍 1 Selected: B
Its a false negative
tomahawk117 👍 2 Selected: B
This one is a false negative. Why? A known vulnerability has been found but the scanner failed to see it. False Positive means the scanner incorrectly identified a vulnerability
test_arrow 👍 4 Selected: A
the vulnerability was NOT present after the scan indicates a false positive
TmNvrWts 👍 3 Selected: A
The correct answer is: A. False positive Explanation: A false positive occurs when a security system incorrectly flags a vulnerability or threat that does not actually exist on the system. In this case, the vulnerability scan reported an issue, but upon further investigation, the administrator confirmed that the vulnerability is not present. Why not the other options? B. False negative – This would mean a vulnerability is present but was not detected, which is the opposite of what happened here. C. True positive – This would mean the vulnerability was correctly identified and is actually present on the system. D. True negative – This would mean the system was correctly identified as not having the vulnerability, but in this case, the scan incorrectly reported it.
ijia_Ai0823 👍 2 Selected: B
B. False negative. Because it is an "identified" vulnerabilities but not reported by a scan.
rrynzon 👍 3
False Positive - Normal or expected activity is incorrectly identified as abnormal or unexpected. False Negative - Abnormal or unexpected activity is incorrectly identified as normal or expected. Therefore, B is the correct answer.
jafyyy 👍 2
A. False Positive - an alert for an event that is not a threat.
qacollin 👍 1 Selected: A
A. GPT

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

A false positive occurs when a vulnerability scanner incorrectly flags a system as having a vulnerability that is not actually present. In this scenario, the scan "identified" (reported) a vulnerability, but the administrator discovered it was "not present" in reality. Because the scanner's positive identification was factually incorrect, this is definitively a false positive.

Why the Other Options Are Wrong

A false negative occurs when a vulnerability genuinely exists on a system but the scanner fails to detect or report it. A true positive means the scanner correctly identified a real vulnerability, while a true negative means the scanner correctly reported that a vulnerability does not exist. None of these match the scenario of a scanner reporting a non-existent vulnerability.

Community Comment Notes

There is significant confusion in the community comments between false positives and false negatives. Some users mistakenly argue for false negative, such as one who claimed "A known vulnerability has been found but the scanner failed to see it," which reverses the question's wording. As user test_arrow correctly pointed out, "the vulnerability was NOT present after the scan indicates a false positive," because the scanner's alert was the false part, and its identification was the positive part.

Official Reference

https://csrc.nist.gov/publications/detail/sp/800-115/final

Exam Strategy

When evaluating scan accuracy terminology, focus strictly on the scanner's action first: if the scanner flagged it, it is a 'positive' result. Then evaluate reality: if the flag is wrong, it is 'false'. Combining these two steps gives the correct classification.

Related Analysis

Which of the following is classified as high availability in

A-Grade

A company is discarding a classified storage array and hires

A-Grade

A company is concerned about employees unintentionally intro

S-Grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide