A penetration tester completed a vulnerability scan against a web server and identified a single but severe vulnerability. Which of the following is the BEST way to ensure this is a true positive?

Running another scanner might yield different results or confirm the first scanner, but it doesn't provide the definitive proof of exploitability that a manual test does.

Performing a manual test on the server allows the penetration tester to actively attempt to exploit the identified vulnerability, directly confirming its existence and potential impact. This hands-on validation is the most definitive way to differentiate a true positive from a false positive reported by an automated scanner.

Checking the results on the scanner only confirms what the scanner *reported*, not necessarily if the vulnerability is a true positive or exploitable in practice.

Looking for the vulnerability online provides general information but does not confirm if the specific server being tested is actually vulnerable or if the scanner's finding is accurate.