Mr. Omkar performed tool-based vulnerability assessment and found two vulnerabilities. During analysis, he found that these issues are not true vulnerabilities. What will you call these issues?

Question

Options

• AFalse positives
• BTrue negatives
• CTrue positives
• DFalse negatives

• A
  91% (21)
• B
  4% (1)
• D
  4% (1)

Explanation

False Positives in Vulnerability Assessment

Why A is correct: When a vulnerability scanning tool reports findings that appear to be vulnerabilities but upon manual analysis are confirmed to not actually exist, these are called false positives - the tool falsely flagged something as a problem when there is no real issue.

Why the other options are wrong:

• B (True negatives): A true negative means the tool correctly identified something as not a vulnerability - this relates to clean/safe items the tool didn't flag, not reported findings that turned out to be harmless.
• C (True positives): A true positive means the tool correctly identified a real vulnerability that actually exists - the opposite of this scenario.
• D (False negatives): A false negative means a real vulnerability exists but the tool missed it and didn't report it - again the opposite of what's described here.

Memory Tip: Think of it this way - "False" means the tool was wrong, and "Positive" means the tool reported it. So a false positive = wrongly reported (flagged as vulnerable, but it's not). Use the phrase: "False alarm = False Positive."

No community discussion yet for this question.