Validating a Telnet Cleartext Finding as a False Positive

SY0-701 By islever Editorial Last updated

Explain various activities associated with vulnerability management. Compare and contrast various types of security controls.

Short answer

A The Nmap telnet-encryption script proves the flagged Telnet service negotiates encryption, so the cleartext-credential finding is a false positive.

Question

After reviewing the following vulnerability scanning report:
Exhibit: Validating a Telnet Cleartext Finding as a False Positive
A security analyst performs the following test:
Exhibit: Validating a Telnet Cleartext Finding as a False Positive
Which of the following would the security analyst conclude for this reported vulnerability?
  1. It is a false positive. Correct Answer
  2. A rescan is required.
  3. It is considered noise.
  4. Compensating controls exist.

Key Takeaways

The exam tests the difference between validating a finding with live evidence (false positive) and accepting an unpatched weakness that is offset by an outside control (compensating control).

This SY0-701 scenario tests vulnerability-validation skills: an Nmap --script telnet-encryption check shows the reported Telnet service supports encryption, making the cleartext-protocol finding a false positive (A).

Common mistake: D — claiming compensating controls exist, because Telnet's encryption option is part of the vulnerable service itself, not a separate control layered around it, and it disproves the finding rather than offsetting it.

Expert Analysis

The scanner's premise

The vulnerability report flags Telnet on TCP/23 because of what the protocol inherently is: RFC 854 Telnet transmits credentials and session data in cleartext, so scanners such as Nessus, Qualys or OpenVAS fire a "cleartext / insecure protocol in use" finding purely by matching the service banner and port number. The finding therefore rests on one assumption — that this Telnet instance is negotiating no encryption.

The analyst's manual verification

The analyst does not re-run the scanner; he interrogates the service directly with Nmap's NSE script --script telnet-encryption, which performs the Telnet option negotiation for encryption (RFC 2946) and reports back "this service supports encryption." That output defeats the assumption the detection rule was built on: this particular Telnet daemon is not sending credentials in the clear, so the specific risk the report describes is not present on this host.

Why that makes it a false positive

A false positive is a reported vulnerability that, after validation, turns out not to exist. That is exactly the state we end in: the report says "insecure cleartext Telnet," the ground truth says "Telnet with encryption available," and the finding must be closed as a validation failure rather than remediated. Correct answer: A.

Why the other choices fail

  • B. A rescan is required applies after you change or patch something and need to confirm remediation. Here no change was made — the analyst validated the existing state with a live test, so the result is a conclusion, not a pending retest.
  • C. It is considered noise describes low-value alerts you tune out through suppression rules; a validated, technically disproven finding is closed as a false positive and the detection logic is tuned, not merely silenced.
  • D. Compensating controls exist is the most seductive trap. A compensating control is an external measure that offsets an unmitigated weakness — network segmentation confining port 23 to a management VLAN, an IPS rule, MFA at a jump host. Telnet's encryption option is a feature of the vulnerable service itself, not a separate control layered around it; and it negates the finding rather than accepting it.

Exam Strategy

When a scenario shows an analyst manually testing a scanner finding, the expected conclusion is usually about validation: either false positive (finding disproven), true positive, or needs rescan (only after a remediation change). Read the manual test output literally — a script result that contradicts the scanner's assumption means the finding never applied. Reserve 'compensating controls' for cases where the weakness still exists and an outside measure reduces its likelihood.

Frequently Asked Questions

What is the difference between a false positive and a compensating control here?

A false positive means the reported weakness does not exist after validation — the Telnet service negotiates encryption, so credentials are not cleartext. A compensating control would mean the cleartext Telnet remains and something else (segmentation, IPS, MFA at a jump host) offsets the risk.

Why is a rescan not the right next step?

A rescan verifies remediation after you patch, reconfigure or remove a service. The analyst made no change — he tested the live service with Nmap's telnet-encryption script, so the validation result itself closes the finding.

Does Telnet with encryption make it as secure as SSH?

No. Telnet encryption is optional and negotiated per session, and Telnet still lacks modern session protections such as strong integrity checks and Kerberos/MFA support. In practice you would still plan migration to SSH and correct the scanner rule that assumes all Telnet is cleartext.

More SY0-701 FAQ →

Community Votes

A
71%
B
9%
D
20%

71% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 51 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 51

  1. mr_reyes 👍 26 Answered A
    False Positive: A false positive occurs when a vulnerability scanner incorrectly identifies a vulnerability that doesn’t actually exist. In this case, the initial vulnerability report flagged the use of an insecure network protocol (Telnet) on the server at 192.168.14.6. However, the follow-up test using Nmap with the telnet-encryption script revealed that the Telnet server supports encryption. Since encryption enhances security, the initial report was incorrect. Therefore, the conclusion is that the initial report was a false positive.
  2. a4e15bd 👍 25
    Telnet itself is inherently insecure and it transmits data including passwords in plaintext making it vulnerable to interception and eavesdropping. While using encryption with telnet is not typical but it is possible, however there are other secure alternatives out there like SSH. So while it is true that Telnet is an unsecure protocol, having encryption is just a compensating control here. So the answer is D.
  3. 420JhonnySins69 👍 15
    Option D is the more reasonable. Compensating controls. is a secondary/supporting security control that prevents the vulnerability from being exploited. (encryption in this case) False Positive: believes that there's a vulnerability but when physically checked is not there. (Telnet is being used, the vulnerability of plain text is there.) False positive https://youtu.be/EJL0h4u871w?list=PL7XJSuT7Dq_UDJgYoQGIW9viwM5hc4C7n&t=6652 Objective (4.3 Explain various activities associated with vulnerability management) https://youtu.be/EJL0h4u871w?list=PL7XJSuT7Dq_UDJgYoQGIW9viwM5hc4C7n&t=7199
  4. dbrowndiver 👍 10 Answered A
    Why This Is a False Positive: 1. Understanding Telnet: General Security Issues: Telnet typically transmits data in plaintext, making it susceptible to eavesdropping and other security vulnerabilities. This is why it is often flagged in security scans. 2. Encryption Support: Security Enhancement: The presence of encryption changes the security profile of Telnet. If encryption is supported and properly implemented, the transmission of data is secure, counteracting the usual vulnerabilities associated with Telnet. 3. Initial Assessment: Misinterpretation: The initial report indicated a vulnerability due to a general assumption that Telnet is insecure, without verifying the specific configuration that includes encryption. 4. Conclusion: False Positive: Since the Telnet server supports encryption, the assumption of insecurity was incorrect. The vulnerability scanner flagged an issue based on typical characteristics rather than the actual configuration of this specific Telnet implementation.
  5. Russell15 👍 6 Answered D
    False positive (A) would mean Telnet was incorrectly flagged as insecure—but Telnet is still a risk by default. Compensating controls (D) is correct because encryption helps mitigate the risk, but the risk still exists.
Show 25 more comments
  1. 7ebb1d5 👍 4
    It's A. Think of it from the perspective of the analyst. If the analyst is checking that telnet supports encryption, then he already knows compensating controls exist. He wouldn't conclude that from the nmap test. The question is, what would the analyst conclude? He would conclude that it was a false positive. He knows Telnet is enabled on his system, knows that it has a compensating control. Checked it with nmap. Therefore, a scan will produce a "false positive" from the analyst's perspective. Even though the scan has identified a real vulnerability.
  2. AutoroTink 👍 3 Answered D
    The security analyst used the Nmap command with a specific script to test the Telnet service on a server. Telnet is traditionally known for transmitting data in plaintext, but the result of nmap states that "this time", telnet supports encryption. (hurray!) Nmap: This is a network scanning tool that can discover devices and services on a computer network. Nmap results: PORT 23/tcp: The specific port (23) for TCP is open. STATE open: The state of the port is open, meaning it is actively accepting connections. SERVICE telnet: The service running on this port is Telnet. REASON syn-ack: This indicates that the port is open because the server responded with a SYN-ACK packet during the TCP handshake. | telnet encryption:: This is the result from the telnet-encryption script. |_ Telnet server supports encryption: The underscore indicates the result of the script, confirming that the Telnet server supports encryption.
  3. Commando9800 👍 3 Answered D
    D. Compensating controls exist. My explaining: Vulnerability detected is : Use of an insecure network protocol Having an encryption doesn't change the fact that Telnet is an insecure protocol The answer would be False Positive if the vulnerability detected was lack of encryption In the end Comptia decide the ultimate truth in this exam so
  4. WTD34 👍 3 Answered D
    The question is asking "what can be concluded". We know that telnet is unsafe by default. We also know that there is an option for encryption as said by the last line "telnet server supports encryption". Thus the answer must be that we can conclude Compensating Controls Exist. answer is D
  5. 1022572 👍 3 Answered D
    The security scan shows telnet port as open and so did the NMAP scan. It is not a false positive A rescan is not required It is not noise D. Compensating Controls is the only correct answer.
  6. Boats 👍 3 Answered D
    Telnet transmits in clear to text. In order to keep that from happing you have to have a compensating control. There for you encrypt it.
  7. Ty13 👍 3 Answered A
    Another garbage question. It's technically a false positive BECAUSE compensating controls exist.
  8. darpanne 👍 2 Answered D
    Most vulnerability scanners (e.g., Nessus, Qualys, OpenVAS) flag Telnet as a vulnerability by default because it is inherently insecure, transmitting data in plaintext. Even with encryption enabled, Telnet remains risky compared to alternatives like SSH due to: Lack of MFA and Kerberos support, No data integrity checks, Susceptibility to brute-force attacks, Absence of session protection. If encryption exists: Modern scanners may detect it and lower the severity but will still warn about Telnet use since the protocol itself is outdated and insecure. Conclusion: Security professionals consider Telnet deprecated and risky, regardless of encryption. Thus, it is not a false positive, and D (compensating controls exist) is correct here.
  9. SHADTECH123 👍 2 Answered A
    Here's the reasoning: The initial vulnerability report indicated a high severity issue due to the use of an insecure network protocol (Telnet). However, the follow-up scan using nmap with the telnet-encryption script showed that the Telnet server supports encryption. This means that while the default perception of Telnet is that it is insecure, the particular Telnet service in question has encryption enabled, mitigating the primary security concern associated with Telnet. Hence, the initial report can be considered a false positive because the Telnet service in question does not suffer from the typical vulnerability of using an insecure protocol.
  10. adea45d 👍 2 Answered D
    ✅ D. Compensating controls exist ✔ Correct answer Why? Encryption support reduces the risk This is a compensating control for using Telnet 🧾 Final Answer: ✅ D. Compensating controls exist This question tests: False positive vs Compensating control Rule of thumb: False positive → vulnerability does NOT exist Compensating control → vulnerability exists BUT risk is reduced Rule of thumb: False positive → vulnerability does NOT exist Compensating control → vulnerability exists BUT risk is reduced
  11. AriGarcia 👍 2 Answered D
    The command nmap -p 23 192.168.14.6 --script telnet-encryption performs the following actions: scans the specified IP address for an open Telnet port (port 23) and then uses the telnet-encryption script to determine if the Telnet server supports encryption, which could indicate whether the server might be vulnerable to certain types of attacks if the encryption is not properly implemented. Since telnet is now encrypted. A compensating control exists (D)
  12. Storcaks 👍 2 Answered D
    The scan only reports that the telnet server SUPPORTS encryption, but there's no information that state that it is required to use encryption by a client. A client that doesn't know the server supports encryption will most likely use default settings without it. Unlike SSH which is always encrypted by default. Telnet itself is inherently insecure just like FTP is. With this in mind the only choice that makes sense is D.
  13. BevMe 👍 2 Answered D
    I think D may be the better answer. The presence of a Telnet server, even with support for encryption, indicates a vulnerability due to the potential risks associated with using Telnet in general. While the encryption feature provides a compensating control, it does not negate the fact that using Telnet is inherently less secure compared to alternatives like SSH.
  14. a4e15bd 👍 2
    I am going to change my answer to A. False positive, because the initial report flagged Telnet as insecure, but the subsequent test showed that encryption which addresses the vulnerability is being used. This indicates the vulnerability was incorrectly reported. So, that makes it a false positive.
  15. dC_Furious 👍 2 Answered D
    I think Compensating Control exist might acrually be the right answear, the Vulnerability scan has correctly identified the vulnerability in this case, port 23 is open, the fact that there is a compensating control doesn't make it a false positive. What do you think?
  16. testpan 👍 2 Answered A
    According to ChatGPT , it says origin report is "Use of an insecure network protocol", but when using nmap to test , it discover "Telnet server supports encryption" , so it means this is contradict to the origin report, so this is False Positive
  17. 41c27e6 👍 2 Answered D
    Impossible to be A, here is why: Telnet iteself is ALWAYS unencrypted. So, the vulnerability indentified is TRUE. However, there are techinques to support Telnet security and data encryption (like VPN).
  18. Catalyst33 👍 2 Answered D
    Adding encryption to telnet does not make it as secure as SSH which the scanner would not pick up as a vulnerability. Sure you have encryption, but what about authentication?
  19. EfaChux 👍 2 Answered D
    Telnet supports encryption but its currently not encrypted, which means there's a vulnerability. Hence there needs to be compensating controls. D is the answer
  20. Twphill 👍 2 Answered D
    It is not a false positive because it correctly identified a vulnerability. However, compensating controls exist to mitigate this vulnerability.
  21. zron 👍 2 Answered D
    Telnet is insecure so it's not a false positive. Using telnet encryption is a compensating control that fixes some of the risks
  22. limatsao 👍 1 Answered A
    The correct answer is: A. It is a false positive. Explanation: The vulnerability scan initially flagged the use of Telnet as insecure because Telnet traditionally sends data, including credentials, in plaintext. However, the nmap test with the --script telnet-encryption option shows that the Telnet server supports encryption, which mitigates the reported risk. This means the vulnerability scanner flagged the issue without accounting for the encryption capability, leading to a false positive. Why the other options are incorrect: B. A rescan is required: The manual test using nmap already confirmed that encryption is supported, so a rescan is unnecessary. C. It is considered noise: Noise refers to irrelevant or unimportant alerts. This finding was important to verify but is ultimately a false positive, not noise. D. Compensating controls exist: The encryption supported by the Telnet server is not a compensating control but a direct mitigation of the issue.
  23. Dakshdabas 👍 1 Answered B
    B. Rescan is required In pointing out that the nmap scan result shows that the Telnet server "supports encryption," but it does not confirm that encryption is actively being used. It simply indicates that the server has the capability to support encryption, but whether or not it's actually enforced during connections is another matter. Given this clarification, the best course of action for the security analyst would likely be B. A rescan is required. Explanation: Since the scan result only shows that the Telnet server supports encryption, but does not confirm that encryption is enforced, a rescan or further testing should be conducted to determine whether: Encryption is actually being used for all Telnet sessions. There is a configuration issue where encryption is supported but not enforced. The rescan should focus on verifying if encryption is mandatory for Telnet connections. If it's not, the vulnerability remains valid and should be addressed.
  24. SHADTECH123 👍 1
    The key difference is: Option A (It is a false positive): This indicates that the initial report of a high-severity vulnerability due to the use of an insecure protocol is incorrect because the Telnet service actually supports encryption. Option D (Compensating controls exist): This would imply that while Telnet is inherently insecure, there are other measures in place to secure the communication, which is not the case here because the Telnet service itself is secured with encryption. Therefore, since the Telnet service supports encryption and the vulnerability no longer exists in the context it was initially reported, the correct conclusion is that it is a false positive, not that compensating controls are mitigating the issue.
  25. Netri 👍 1 Answered A
    The security analyst would most likely conclude: A. It is a false positive. Explanation: The vulnerability report flagged the Telnet service as insecure because Telnet traditionally uses unencrypted communication, which is considered insecure. However, the analyst performed a manual test using Nmap and discovered that the Telnet server supports encryption, which contradicts the original report. Since the service supports encryption, the vulnerability related to insecure communication (typically associated with Telnet) is not valid, meaning the original finding in the report is incorrect. Thus, this situation represents a false positive.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide