What is a false positive in vulnerability scanning?
- A vulnerability that was missed by the scanner
- A vulnerability that was not actually exploitable
- A vulnerability that has already been patched
- A report of a vulnerability that does not exist ✓
Correct answer: A report of a vulnerability that does not exist
A false positive in vulnerability scanning is a report that flags a vulnerability as present when it does not actually exist on the target system, making Option D correct. Option A describes a false negative, which is when a real vulnerability goes undetected by the scanner. Option B describes a non-exploitable vulnerability, which is a true positive finding that lacks a viable attack path, not a false positive. Option C describes a patched vulnerability, which would be a true positive or a stale finding rather than an erroneous detection.
Topic: · vulnerability scanning, false positive, penetration testing, security assessment