nerdexam
GIAC

GSEC · Question #365

You are the security director for an off-shore banking site. From a business perspective, what is a major factor to consider before running your new vulnerability scanner against the company's…

The correct answer is C. It may generate false positive results. From a business perspective, false positive results from a vulnerability scanner are the primary concern because they generate unnecessary remediation work and can disrupt normal business operations.

Incident Handling, Risk, and Governance

Question

You are the security director for an off-shore banking site. From a business perspective, what is a major factor to consider before running your new vulnerability scanner against the company's business systems?

Options

  • AIt may harm otherwise healthy systems.
  • BIt may produce false negative results.
  • CIt may generate false positive results.
  • DIt may not return enough benefit for the cost.

How the community answered

(42 responses)
  • A
    5% (2)
  • B
    2% (1)
  • C
    81% (34)
  • D
    12% (5)

Why each option

From a business perspective, false positive results from a vulnerability scanner are the primary concern because they generate unnecessary remediation work and can disrupt normal business operations.

AIt may harm otherwise healthy systems.

Modern vulnerability scanners are designed to be passive and non-destructive, making actual system harm an uncommon outcome and a lesser business concern than operational overhead from false positives.

BIt may produce false negative results.

False negatives are a security risk concern (missed real vulnerabilities), but they do not generate the immediate, visible, and costly operational disruption that false positives do from a business standpoint.

CIt may generate false positive results.Correct

False positives occur when the scanner incorrectly flags healthy, functioning systems as vulnerable, which in a banking environment causes direct business impact - engineers waste time investigating phantom issues, unnecessary patches may be applied to stable systems causing downtime, and management credibility in the security program erodes.

DIt may not return enough benefit for the cost.

Cost-benefit analysis is typically performed before deploying a scanner, not treated as an outcome of running it, so it does not represent a factor introduced by the scan itself.

Concept tested: Business impact of vulnerability scanner false positives

Source: https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-115.pdf

Topics

#vulnerability scanning#false positives#security assessment#risk management

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GSEC Practice