Mr. Omkar performed tool-based vulnerability assessment and found two vulnerabilities. During analysis, he found that these issues are not true vulnerabilities. What will you call these issues?

Question

Options

• AFalse positives
• BTrue negatives
• CTrue positives
• DFalse negatives

• A
  93% (37)
• B
  5% (2)
• D
  3% (1)

Explanation

False positives occur when a tool reports something as a vulnerability, but upon further analysis, it turns out not to be a real vulnerability - exactly what Mr. Omkar experienced. The tool flagged two issues, but human analysis confirmed they were not actual threats, making them false alarms or false positives.

Why the other options are wrong:

• True negatives (B): These occur when a tool correctly identifies that something is not a vulnerability - no alert is raised and it's genuinely safe; no false report is involved.
• True positives (C): These are real vulnerabilities that the tool correctly identifies as genuine threats - the opposite of this scenario.
• False negatives (D): These are actual vulnerabilities that the tool missed and failed to report - dangerous oversights, not false alarms.

Memory Tip: Think of it this way - "False Positive = Falsely Accused." The tool positively flagged it as a vulnerability, but that claim was false. Just like an innocent person being falsely accused of a crime, the "vulnerability" was flagged but proven innocent upon investigation.

No community discussion yet for this question.