In the context of vulnerability assessment, what is the significance of false positives?

Question

Options

• AThey indicate vulnerabilities that do not actually exist.
• BThey represent accurately identified vulnerabilities.
• CThey are undetected vulnerabilities.
• DThey refer to vulnerabilities that are already mitigated.

• A
  88% (36)
• B
  5% (2)
• C
  5% (2)
• D
  2% (1)

Explanation

False positives in vulnerability assessment are alerts or findings that flag a vulnerability where none actually exists - making A correct. The scanner or tool incorrectly reports a system as vulnerable when it is not, wasting analyst time and potentially causing unnecessary remediation effort.

• B is wrong because accurately identified vulnerabilities are called true positives, not false positives.
• C is wrong because undetected vulnerabilities describe false negatives - the tool missed a real vulnerability entirely.
• D is wrong because already-mitigated vulnerabilities are simply closed/resolved findings, not a detection accuracy concept.

Memory tip: Think of "false" as the key word - the positive (alert) is false, meaning the problem doesn't really exist. Pair it with its opposite: a false negative is when a real problem goes undetected (the alert that should have fired didn't).

No community discussion yet for this question.