SY0-501 · Question #25
An organization is using a tool to perform a source code review. Which of the following describes the case in which the tool incorrectly identifies the vulnerability?
The correct answer is C. False positive. A false positive occurs when a security tool incorrectly flags a benign item as a vulnerability, leading to a misidentification.
Question
An organization is using a tool to perform a source code review. Which of the following describes the case in which the tool incorrectly identifies the vulnerability?
Options
- AFalse negative
- BTrue negative
- CFalse positive
- DTrue positive
How the community answered
(40 responses)- A5% (2)
- B3% (1)
- C83% (33)
- D10% (4)
Why each option
A false positive occurs when a security tool incorrectly flags a benign item as a vulnerability, leading to a misidentification.
A false negative occurs when a security tool fails to detect an actual vulnerability that is present, missing a real threat.
A true negative occurs when a security tool correctly determines that no vulnerability exists in a section of code where none is present.
A false positive describes an outcome where a security tool reports the presence of a vulnerability (a 'positive' detection), but upon further investigation, no actual vulnerability exists, meaning the detection was 'false'. In the context of a source code review tool, this means the tool identified a problem that isn't truly there.
A true positive occurs when a security tool correctly identifies an actual vulnerability that is present in the source code.
Concept tested: Security tool alert classification (False Positive)
Source: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-false-positives-negatives
Topics
Community Discussion
No community discussion yet for this question.