nerdexam
CompTIA

SY0-501 · Question #223

During a monthly vulnerability scan, a server was flagged for being vulnerable to an Apache Struts exploit. Upon further investigation, the developer responsible for the server informs the security…

The correct answer is A. The finding is a false positive and can be disregarded. When a vulnerability scanner flags software that is confirmed to not exist on a system, the result is a false positive and requires no remediation action against the flagged vulnerability.

Submitted by manish99· Mar 4, 2026Threats, vulnerabilities, and mitigations

Question

During a monthly vulnerability scan, a server was flagged for being vulnerable to an Apache Struts exploit. Upon further investigation, the developer responsible for the server informs the security team that Apache Struts is not installed on the server. Which of the following BEST describes how the security team should reach to this incident?

Options

  • AThe finding is a false positive and can be disregarded
  • BThe Struts module needs to be hardened on the server
  • CThe Apache software on the server needs to be patched and updated
  • DThe server has been compromised by malware and needs to be quarantined.

How the community answered

(58 responses)
  • A
    72% (42)
  • B
    3% (2)
  • C
    7% (4)
  • D
    17% (10)

Why each option

When a vulnerability scanner flags software that is confirmed to not exist on a system, the result is a false positive and requires no remediation action against the flagged vulnerability.

AThe finding is a false positive and can be disregardedCorrect

A false positive occurs when a vulnerability scanner incorrectly identifies a vulnerability that does not actually exist on the target system. Since the developer has confirmed Apache Struts is not installed, the scanner produced an inaccurate result, meaning there is no real vulnerability to remediate. The security team should document the false positive and tune the scanner to reduce similar erroneous alerts in the future.

BThe Struts module needs to be hardened on the server

Hardening the Struts module is not applicable because the developer confirmed Apache Struts is not installed on the server, so there is no module present to harden.

CThe Apache software on the server needs to be patched and updated

Patching Apache software is irrelevant to this scenario because the flagged vulnerability is specific to the Apache Struts framework, which has been confirmed as absent from the server.

DThe server has been compromised by malware and needs to be quarantined.

Quarantining the server for malware is unwarranted because there is no evidence of compromise; the scanner result is simply an inaccurate detection, not an indicator of malicious activity.

Concept tested: Identifying and handling vulnerability scan false positives

Source: https://www.nist.gov/publications/technical-guide-information-security-testing-and-assessment

Topics

#vulnerability scanning#false positives#vulnerability management#Apache Struts

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SY0-501 Practice