mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A vulnerability scanner reports a medium-severity…
A vulnerability scanner reports a medium-severity finding on a web server. After investigating, the system administrator claims the finding is a false positive because the service in question is not actually running. Which step should the security analyst take next?
⚠ Common exam trap
Test-takers frequently assume the administrator's claim is authoritative and skip verification, but the CISSP exam emphasizes that security analysts must always validate findings through independent technical means before closing or escalating.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify the service status using system commands or network scans
The security analyst must independently verify the administrator's claim before taking any action. The vulnerability scanner may have detected a service on a different port or the service may be bound to a non-standard interface; using system commands (e.g., `netstat -tulpn` or `ss -tulpn`) or a targeted network scan (e.g., `nmap -sV -p <port> <target>`) provides objective evidence of whether the service is actually listening. Relying solely on the administrator's assertion without verification could lead to a missed true positive, especially if the service is hidden or misconfigured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Verify the service status using system commands or network scans
Why this is correct
This is the correct initial action. When a vulnerability scanner reports a finding, especially if an administrator disputes it, independent technical verification is crucial to confirm its existence. Using system commands (e.g., `netstat -tuln`, `systemctl status <service>`) or targeted network scans (e.g., `nmap -p <port> <IP>`) directly validates whether the reported service is actually running or listening, thereby confirming if the finding is a true positive or a false positive before proceeding with remediation or risk acceptance.
- ✗
Remove the finding from the report since the administrator confirmed it
Why it's wrong here
Removing a finding solely based on an administrator's confirmation is a critical error in vulnerability management. While administrator input is valuable, it must always be corroborated with objective, technical evidence. Relying on unverified claims bypasses due diligence, introduces the risk of overlooking a genuine vulnerability due to human error or miscommunication, and undermines the integrity of the vulnerability assessment process.
- ✗
Close the finding as accepted risk
Why it's wrong here
Closing a finding as 'accepted risk' is premature and inappropriate without first verifying its existence. Risk acceptance is a formal decision made by management for *validated* risks that are understood, quantified, and deemed acceptable to the organization. Accepting a risk that has not been technically confirmed could lead to allocating resources to manage a non-existent threat or, worse, formally accepting a real, unquantified vulnerability without proper analysis.
- ✗
Escalate the issue to management for risk acceptance
Why it's wrong here
Escalating an unverified finding to management for risk acceptance is an inefficient and unprofessional approach. The security team's responsibility includes performing initial technical due diligence to validate findings before involving higher-level decision-makers. Presenting management with unconfirmed issues wastes their time, demonstrates a lack of thoroughness, and can erode confidence in the security team's ability to accurately assess and report risks.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.