mediumMultiple ChoiceObjective-mapped
Validate False Positives in Vulnerability Scans
A security analyst runs a vulnerability scan against a web application and receives a report listing several critical vulnerabilities. However, the development team argues that many of these findings are false positives. Which of the following is the BEST next step for the analyst?
Quick Answer
The answer is to manually verify a sample of the findings to confirm true vs. false positives. This is the best next step because automated vulnerability scanners rely on techniques like banner grabbing and service fingerprinting, which can produce inaccurate results when services respond with generic banners or when the scanner misidentifies a patched service as vulnerable. Manual verification, such as testing the exploitability of a finding against the actual application behavior and configuration, is the definitive method to validate false positives in vulnerability scans. On the CISSP exam, this question tests your understanding of the vulnerability management lifecycle and the critical distinction between automated scanning and manual validation—a common trap is to immediately patch or ignore all findings without verification. Remember the mnemonic “Scan, Sample, Verify” to recall that after scanning, you must sample and manually verify before remediation.
⚠ Common exam trap
It's easy for candidates to choose Option D (retune the scanner) because they assume tuning reduces false positives, but the CISSP emphasizes that validation through manual testing must precede any scanner configuration changes to avoid missing real vulnerabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Manually verify a sample of the findings to confirm true vs. false positives.
Manual verification is the definitive method to distinguish true positives from false positives in vulnerability scanning. Automated scanners can produce false positives due to factors like incomplete service fingerprinting or reliance on banner grabbing, which may not reflect actual exploitability. The analyst must validate a representative sample of findings against the actual application behavior and configuration before taking further action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Re-scan the application with the same settings to confirm the results.
Why it's wrong here
Re-scanning with the same settings will produce the same potentially inaccurate results.
- ✓
Manually verify a sample of the findings to confirm true vs. false positives.
Why this is correct
Manual verification helps identify false positives and prioritize real vulnerabilities.
- ✗
Escalate all critical findings to management immediately.
Why it's wrong here
Escalating without verification may waste management's time on false positives.
- ✗
Retune the vulnerability scanner to reduce false positives and re-scan.
Why it's wrong here
Retuning without understanding the current findings may miss real issues.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Vulnerability scan
A vulnerability scan is an automated process that checks systems, networks, and applications for known security weaknesses or misconfigurations.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISSP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A vulnerability scanner reports a medium-severity finding on a web server. After investigating, the system administrator claims the finding is a false positive because the service in question is not actually running. Which step should the security analyst take next?
medium- ✓ A.Verify the service status using system commands or network scans
- B.Remove the finding from the report since the administrator confirmed it
- C.Close the finding as accepted risk
- D.Escalate the issue to management for risk acceptance
Why A: The security analyst must independently verify the administrator's claim before taking any action. The vulnerability scanner may have detected a service on a different port or the service may be bound to a non-standard interface; using system commands (e.g., `netstat -tulpn` or `ss -tulpn`) or a targeted network scan (e.g., `nmap -sV -p <port> <target>`) provides objective evidence of whether the service is actually listening. Relying solely on the administrator's assertion without verification could lead to a missed true positive, especially if the service is hidden or misconfigured.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.