easyMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A security analyst has identified a large number…
A security analyst has identified a large number of false positives in a vulnerability scan report. Which of the following is the BEST way to reduce false positives in future scans?
⚠ Common exam trap
CompTIA often tests the misconception that manual verification or exclusion is a valid long-term fix, but the correct answer always involves adjusting the scanner's configuration to prevent false positives at the source.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tune the vulnerability scanner's configuration
Tuning the vulnerability scanner's configuration (option D) is the best approach because it allows the analyst to adjust scan parameters such as credential settings, plugin thresholds, and network timeouts to match the target environment. This reduces false positives by ensuring the scanner accurately identifies real vulnerabilities rather than reporting benign deviations or configuration mismatches. For example, enabling authenticated scans with valid credentials eliminates many false positives related to missing patches that are actually installed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Manually verify each vulnerability before reporting
Why it's wrong here
Manually verifying each vulnerability before reporting is a reactive measure that addresses the symptom rather than the root cause of false positives. While necessary for accurate reporting, this approach does not prevent the scanner from generating a large number of incorrect findings in the first place. It is a time-consuming and inefficient process that fails to improve the scanner's underlying accuracy for future scans.
- ✗
Increase the frequency of vulnerability scans
Why it's wrong here
Increasing the frequency of vulnerability scans will not reduce the occurrence of false positives; instead, it will merely multiply the number of reports containing these inaccurate findings. Running more scans with an untuned configuration means generating a larger volume of data that still requires extensive manual review to differentiate true vulnerabilities from false alarms. This approach exacerbates the problem by increasing the workload without improving the quality of the scan results.
- ✗
Exclude the false positives from the report
Why it's wrong here
Excluding false positives from a report is a post-scan filtering action that cleans up a specific output, but it does not address the scanner's configuration or detection logic. While it makes a single report more accurate, the scanner will continue to identify the same non-existent vulnerabilities in subsequent scans. This method requires repeated manual intervention and fails to proactively reduce the generation of false positives at their source.
- ✓
Tune the vulnerability scanner's configuration
Why this is correct
Tuning the vulnerability scanner's configuration is the most effective and proactive method to reduce false positives by directly refining its detection capabilities. This involves adjusting parameters such as plugin selection, sensitivity levels, authentication credentials, and exclusion rules to better match the target environment. Proper tuning ensures the scanner accurately distinguishes between actual vulnerabilities and benign conditions, significantly improving the precision of future scan results and reducing analyst workload.
Go deeper
Related to this question
Learn chapter
Network Traffic Analysis
Key term
Vulnerability scan
A vulnerability scan is an automated process that checks systems, networks, and applications for known security weaknesses or misconfigurations.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.