Mary found a high vulnerability during a vulnerability scan and notified her server team. After analysis, they sent her proof that a fix to that issue had already been applied. The vulnerability…

Question

Options

• AFalse-negative
• BFalse-positive
• CBrute force attack
• DBackdoor

• B
  92% (23)
• C
  4% (1)
• D
  4% (1)

Explanation

False-Positive Explained

Option B is correct because a false-positive occurs when a vulnerability scanner reports a vulnerability that doesn't actually exist (or has already been remediated) - in Mary's case, the patch had already been applied, meaning the threat was not real, yet the scanner flagged it anyway. A false-negative (A) is the opposite scenario, where a real vulnerability exists but the scanner fails to detect it - which is arguably more dangerous. A brute force attack (C) is an attack method involving repeated attempts to guess credentials or encryption keys, which is completely unrelated to scan reporting accuracy. A backdoor (D) is a hidden method of bypassing normal authentication, also unrelated to scan result accuracy.

Memory Tip: Think of it like a medical test - a false-positive means the test says you're sick when you're actually healthy. Similarly, a false-positive vulnerability means the scanner says there's a problem when there actually isn't one. If you remember "false = wrong, positive = found a problem," you'll always distinguish it from a false-negative.

No community discussion yet for this question.