Which of the following is the primary reason why false negatives on a vulnerability scan should be a concern?

Question

Options

• AThe system has vulnerabilities that are not being detected.
• BThe time to remediate vulnerabilities that do not exist is excessive.
• CVulnerabilities with a lower severity will be prioritized over critical vulnerabilities.
• DThe system has vulnerabilities, and a patch has not yet been released.

• A
  92% (49)
• B
  2% (1)
• C
  4% (2)
• D
  2% (1)

Explanation

A false negative occurs when a vulnerability scanner fails to detect a vulnerability that actually exists - meaning the system is genuinely compromised or exposed, but the scan report gives a false sense of security. This is the primary concern because undetected vulnerabilities leave the system open to exploitation without the security team's knowledge, making A correct.

Why the distractors are wrong:

• B describes false positives, not false negatives - false positives waste time chasing vulnerabilities that don't exist, not false negatives.
• C describes a prioritization error in the remediation workflow, not a scanning detection failure - this is a process/triage problem, not a scan accuracy problem.
• D describes an unpatched vulnerability that was correctly detected - the patch availability issue is separate from whether the scanner found the vulnerability in the first place.

Memory tip: Think of a false negative as a "missed alarm" - the fire is real, but the smoke detector didn't go off. The danger isn't that you're chasing a false alarm (B), it's that a real fire is spreading undetected (A). Always associate false negatives with hidden real risk.

No community discussion yet for this question.