CompTIA Security+ (SY0-701)Security OperationsMedium
A security team is regularly reviewing vulnerability scan reports. They frequently encounter findings that are reported as vulnerabilities but, after manual inspection, are determined to be false positives due to specific compensating controls or environmental factors. What process should the team implement to manage these recurring false positives effectively?
- ATune the vulnerability scanner's configuration and exceptions
- BDisable the scanning tool for those specific hosts
- CImplement a full penetration test after each scan
- DIncrease the frequency of vulnerability scans
Show answer & explanationAnswer & explanation
Correct answer: A. Tune the vulnerability scanner's configuration and exceptions
Tuning the vulnerability scanner's configuration involves adjusting its settings, such as adding exceptions or exclusions for specific findings that are known false positives due to compensating controls or environmental factors. This prevents the scanner from repeatedly reporting them, improving the signal-to-noise ratio of scan results.
Why the other options are wrong
- B. Disabling the scanner for hosts would leave them unmonitored for actual vulnerabilities, creating a significant security gap.
- C. A full penetration test is a labor-intensive activity for assessing overall security posture, not a method for managing recurring false positives from automated scans.
- D. Increasing scan frequency would only generate more false positives and increase workload without addressing the root cause.
Vulnerability Scanner Tuning
The process of adjusting a vulnerability scanner's configuration, including adding exceptions or exclusions, to reduce false positives and improve the accuracy of scan results.
- Reduces alert fatigue for security analysts.
- Improves the signal-to-noise ratio of scan reports.
- Ensures focus on actual, exploitable vulnerabilities.
Memory trick: Tune the scanner to sing the right notes, not false ones.