A vulnerability scan that identifies a vulnerability that is actually exploitable is called what?

A vulnerability scan that identifies a vulnerability that is actually exploitable is called what?

• A. False negative
• B. True negative
• C. True positive
• D. False positive

Answer: (C)

When evaluating vulnerability findings, the key idea is whether the scanner’s finding matches reality in terms of exploitability. If the scanner identifies a vulnerability and that vulnerability is actually exploitable in the real environment, that result is a true positive. It means the tool correctly detected a real risk that an attacker could potentially exploit under the right conditions. By contrast, a false positive would be a reported vulnerability that isn’t actually exploitable, a false negative would be an exploitable vulnerability that the scanner missed, and a true negative would be no vulnerability found and no exploitable risk present.

When evaluating vulnerability findings, the key idea is whether the scanner’s finding matches reality in terms of exploitability. If the scanner identifies a vulnerability and that vulnerability is actually exploitable in the real environment, that result is a true positive. It means the tool correctly detected a real risk that an attacker could potentially exploit under the right conditions.

By contrast, a false positive would be a reported vulnerability that isn’t actually exploitable, a false negative would be an exploitable vulnerability that the scanner missed, and a true negative would be no vulnerability found and no exploitable risk present.