Free sampleVulnerability Managementhard
In vulnerability management, why is finding validation treated as a distinct step rather than something the scanner alone completes?
- AValidation confirms whether a reported finding is real and exploitable in context, separating true positives from false positives Correct
- BValidation raises the CVSS base score of confirmed findings so they automatically move to the top of the remediation queue
- CValidation re-runs the same scan with credentials so the tool can overwrite its earlier unauthenticated results in the report
- DValidation removes low-severity informational entries from the output so the analyst reviews a shorter and cleaner result set
Explain that finding validation confirms whether a scanner result is real and exploitable, distinguishing true positives from false positives. Scanners infer weaknesses from signatures and version data and cannot always confirm exploitability in a specific environment, so a separate validation step tests the claim and prevents effort being spent on false positives.
Why A is correct: Validation exists to test the scanner's claim against the actual environment, which is what distinguishes genuine findings from false positives.
Why B is wrong: CVSS base scores are intrinsic to the vulnerability and are not altered by validation, so this misdescribes what validation does.
Why C is wrong: A credentialed re-scan can help, but validation is about confirming reality, not merely rewriting a report entry, so this narrows the purpose too far.
Why D is wrong: Trimming informational noise is report hygiene, not the confirmation of whether a flagged weakness genuinely exists.