Match each vulnerability scanning concept to its definition.
Drag a concept onto its matching description — or click a concept then click the description.
Alert on non-existent vulnerability
Missed actual vulnerability
Scan with authenticated access
Scan without authenticated access
Standard severity rating for vulnerabilities
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
True Positive: Alert correctly identifies a real vulnerability
Understanding these four concepts is critical for interpreting scan results correctly. True positives and true negatives are desirable outcomes, while false positives and false negatives represent errors. Common confusions include swapping true/false positives and negatives, as shown in the distractors.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
True Positive: Alert correctly identifies a real vulnerability
Why this is correct
A true positive occurs when the scanner's alert matches reality: an actual exploitable weakness is present on the host and the tool correctly flags it. This outcome drives legitimate remediation work and is the confusion-matrix cell every well-tuned scanning program tries to maximize relative to false alerts.
False Positive: Alert incorrectly indicates a vulnerability that does not exist
Why this is correct
A false positive means the scanner raised an alert for a vulnerability that does not truly exist on the target, often because of version-string guessing, missing credentials, or a signature that doesn't account for a vendor backport. Analysts waste triage time chasing these until the rule or scan configuration is tuned.
True Negative: No alert when there is no vulnerability
Why this is correct
A true negative is the correct, quiet outcome where no vulnerability exists and the scanner properly generates no alert. It confirms detection accuracy on clean assets and, unlike the other three outcomes, requires no analyst follow-up because the tool's assessment matches the system's actual secure state.
False Negative: No alert when there is a vulnerability
Why this is correct
A false negative is the most dangerous outcome: a real, exploitable vulnerability exists but the scanner fails to detect it and issues no alert, so the exposure goes unremediated and can be silently exploited. Causes include outdated plugin signatures, evasive configurations, or scan scope gaps that skip the affected asset.
True Positive: Alert incorrectly indicates a vulnerability that does not exist
Why it's wrong here
This wording mislabels a false positive as a true positive. A true positive requires the flagged vulnerability to genuinely exist; an alert for a nonexistent flaw, by definition, belongs in the false-positive category regardless of how the scanner phrases its output.
False Negative: No alert when there is no vulnerability
Why it's wrong here
This description actually matches a true negative, not a false negative. A false negative specifically requires an undetected real vulnerability to be present; the absence of both an alert and an underlying flaw is the correctly-quiet true-negative case, not a detection failure.
Go deeper
Learn chapter
Vulnerability Prioritization
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
Vulnerability scanning
Vulnerability scanning is an automated process that identifies security weaknesses in systems, networks, and applications by comparing them against known vulnerability databases.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.