After reviewing the following vulnerability scanning report: A security analyst performs the following test: Which of the following would the security analyst conclude for this reported vulnerability?

Question

Exhibits

Options

• AIt is a false positive.
• BA rescan is required.
• CIt is considered noise.
• DCompensating controls exist.

• A
  18% (6)
• B
  6% (2)
• C
  6% (2)
• D
  71% (24)

Explanation

Option D is correct because when a vulnerability scanner reports a finding but manual verification (such as attempting to exploit it) shows the attack cannot succeed, this indicates that compensating controls - such as a firewall rule, IDS/IPS, network segmentation, or access restriction - are blocking the exploit path. The vulnerability is real and present, but additional security controls reduce or eliminate its practical risk.

Why the distractors are wrong:

• A (False positive): A false positive means the vulnerability doesn't actually exist in the system. Here, the vulnerability is real - it's just mitigated by other controls.
• B (Rescan required): Rescanning is appropriate when results are unclear or inconclusive, not when the analyst has already confirmed the finding and its context through manual testing.
• C (Noise): Noise refers to low-relevance, repetitive, or irrelevant alerts that clutter reports. This is a confirmed finding with context - not noise.

Memory tip: Think of compensating controls as a "locked door behind a broken window" - the window (vulnerability) is broken, but the door (compensating control) still keeps the intruder out. On the exam, if a vulnerability exists but exploitation fails, your first instinct should be compensating controls, not false positive.

No community discussion yet for this question.