hardMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A security analyst is reviewing the output of a…
A security analyst is reviewing the output of a vulnerability scan and notices that a critical vulnerability on a Linux server has been reported as 'Confirmed' by the scanner. The analyst checks the system and finds that the actual vulnerability does not exist because a kernel upgrade was applied via a yum update but the scanner did not detect the change. Which of the following is the MOST likely cause?
⚠ Common exam trap
CompTIA often tests the distinction between authenticated and unauthenticated scanning, and the trap here is that candidates assume a 'Confirmed' status means the scanner has verified the vulnerability through deep inspection, when in fact it may only indicate that the scanner's unauthenticated checks matched a signature, not that it has actual system-level access to confirm the patch state.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The scanner was not configured with proper credentials for authenticated scanning
The vulnerability scanner reported a 'Confirmed' critical vulnerability that no longer exists after a kernel upgrade via yum. This indicates the scanner performed an unauthenticated scan, relying on banner grabbing or service version detection, which cannot verify the actual installed kernel version. With proper credentials (e.g., SSH keys or a service account), the scanner would have performed an authenticated scan, queried the package manager (rpm -q kernel), and correctly identified that the kernel was updated, thus not flagging the vulnerability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The vulnerability database was not updated before the scan
Why it's wrong here
An outdated vulnerability database primarily leads to false negatives, where new vulnerabilities (CVEs) are missed because the scanner lacks the definitions to detect them. While it could theoretically flag very old, patched vulnerabilities if the scanner relies solely on banner grabbing without authentication, the core issue of a "Confirmed" false positive on a *patched* system is more directly attributed to the scanner's inability to verify the internal state, not merely an old list of known issues.
- ✗
The scanner is configured to alert on missing patches only
Why it's wrong here
If the scanner were strictly configured to alert only on genuinely missing patches, and the system was indeed patched, it should not have reported a "Confirmed" vulnerability. The fact that a false positive occurred, indicating the scanner *believed* a vulnerability existed despite the system being patched, contradicts a configuration that would prevent such an erroneous alert. This option describes a setting that would prevent the observed false positive.
- ✓
The scanner was not configured with proper credentials for authenticated scanning
Why this is correct
Without proper credentials, a vulnerability scanner performs unauthenticated scans, relying on network-level probes and banner grabbing. This method often leads to false positives because it cannot log into the target system to verify actual patch levels, installed software versions, or configuration files. For example, a service banner might display an older version string even if the underlying software has been patched or backported, causing the scanner to incorrectly flag a vulnerability as "Confirmed" on a secure system.
- ✗
The scanner's plugins for Linux are outdated
Why it's wrong here
Outdated scanner plugins can certainly contribute to inaccuracies, potentially causing false positives by misinterpreting current system states or using obsolete vulnerability detection logic. However, the scenario of detecting outdated service banners on an otherwise patched system points more specifically to the *method* of detection—unauthenticated banner grabbing—rather than the specific content or age of the plugins themselves. While a factor, it's less direct than the lack of authentication for this particular type of false positive.
Go deeper
Related to this question
Learn chapter
Endpoint Detection and Response
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
Detection
Detection is the process of identifying potential security incidents or anomalies by analyzing system data, logs, and network traffic.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.