Question

Alice is a security engineer tasked with performing vulnerability scans for her organization. She encounters a false positive error in one of her scans. What should she do about this?

A. Verify that it is a false positive, and then document the exception
B. Implement a workaround
C. Update the vulnerability scanner
D. Use an authenticated scan, and then document the vulnerability

Answer 1

When encountering a false positive error in a vulnerability scan, Alice should verify it, document the exception, and not implement workarounds or update the scanner. An authenticated scan can be performed to validate the vulnerability, but the documentation is still necessary.

Step-by-step explanation:

When encountering a false positive error in a vulnerability scan, Alice should first verify that it is indeed a false positive by thoroughly investigating the vulnerability. She can do this by checking other sources or performing additional tests. Once she is confident that it is a false positive, she should document the exception, specifying the reason for the false positive and any steps taken to confirm it. This documentation will help communicate the false positive to others in the organization and prevent unnecessary remediation efforts.

Implementing a workaround or updating the vulnerability scanner are not appropriate responses to a false positive error. Implementing a workaround would be a temporary solution for a non-existent vulnerability, while updating the vulnerability scanner may not necessarily address the specific false positive encountered.

If Alice wants to further validate the vulnerability, an authenticated scan can be performed. This type of scan uses valid credentials to access the target system and may provide additional information about the vulnerability. However, it is important to note that even after an authenticated scan, if Alice is confident it is a false positive, she should still document the vulnerability as an exception.