hardMultiple ChoiceObjective-mapped
CS0-003 Practice Question: Your organization has deployed a new web…
Your organization has deployed a new web application on a Linux server. The application uses a custom database port (TCP 3307). During a routine vulnerability scan, the scanner reports a critical vulnerability: 'MySQL Server - Unrestricted File Upload (CVE-20XX-XXXX)'. The system administrator confirms that MySQL is not installed; the custom database uses PostgreSQL on port 3307. The scanner likely misidentified the service due to port-based fingerprinting. On further investigation, you find that the scanner's fingerprinting database has an incorrect mapping for port 3307. The PostgreSQL version is current and fully patched. The environment is production and cannot be disrupted. Which of the following is the BEST action to take?
⚠ Common exam trap
CompTIA often tests the candidate's ability to distinguish between a true vulnerability and a false positive caused by service misidentification, trapping those who jump to patching or blocking without verifying the actual service running on the port.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mark the vulnerability as a false positive and suppress it for this asset.
The vulnerability report is based on a false positive: the scanner misidentified the service on port 3307 as MySQL due to an incorrect port mapping in its fingerprinting database, while the actual service is a fully patched PostgreSQL. Since MySQL is not installed and no actual vulnerability exists, marking the finding as a false positive and suppressing it for this asset is the appropriate response in a production environment that cannot be disrupted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Manually update the scanner's database to correct the port mapping.
Why it's wrong here
This action is incorrect because the scanner's database likely contains accurate signatures for identifying MySQL services. The issue is not a flaw in the scanner's port mapping configuration or its database definitions for MySQL, but rather the scanner's misinterpretation of the service running on port 3307, which is a web application, not a MySQL database. Therefore, updating the database would not resolve the false positive.
- ✗
Schedule an immediate patch of the supposed MySQL vulnerability.
Why it's wrong here
Scheduling a patch for a MySQL vulnerability is inappropriate because the asset in question is hosting a web application, not a MySQL database. The scanner has incorrectly identified the service running on port 3307, leading to a false positive. Attempting to patch a non-existent vulnerability would be a misallocation of resources and could potentially disrupt the legitimate web application.
- ✗
Apply a workaround to block file upload functionality on port 3307.
Why it's wrong here
This action is misguided because the reported vulnerability is for MySQL, which is a false positive, not a legitimate vulnerability in the web application itself. Furthermore, blocking file upload functionality would be a specific mitigation for a web application vulnerability, not a response to a scanner's misidentification of a service as MySQL. Implementing such a workaround would be unnecessary and misdirected.
- ✓
Mark the vulnerability as a false positive and suppress it for this asset.
Why this is correct
This is the correct action because the scanner has mistakenly identified a web application running on port 3307 as a MySQL database, leading to a false positive vulnerability report. Marking it as a false positive and suppressing it for this asset ensures that security teams are not distracted by irrelevant alerts, allowing them to focus on genuine threats and maintain an accurate vulnerability posture.
Go deeper
Related to this question
Learn chapter
Endpoint Detection and Response
Key term
False positive
A false positive is an alert or result that indicates a security threat or vulnerability exists when in fact there is no real issue.
Key term
Vulnerability scan
A vulnerability scan is an automated process that checks systems, networks, and applications for known security weaknesses or misconfigurations.
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.