Following an infrastructure update, a security team conducts an external unauthenticated vulnerability scan against an enterprise web server. The report highlights several critical kernel vulnerabilities based on the software version header returned by the web service. However, host-based agent logs confirm the operating system was fully patched, and the service header was intentionally customized for version obfuscation. Which of the following best accounts for the high-severity findings in the external scan report?
- The unauthenticated scan relied on banner grabbing, producing a false positive due to modified version headers.Answer
- BThe web server firewall acted as a compensating control that dynamically patched the kernel during the external test.
- CThe host-based agent misclassified the network service as a client-side script execution vulnerability.
- DThe external vulnerability scanner operated as a detective control that actively exploited the host memory.
Answer
The external scan produced a false positive because unauthenticated banner grabbing inferred vulnerabilities from customized version headers rather than actual system patch levels.
Unauthenticated vulnerability scans perform banner grabbing to infer software versions from service responses. When version headers are customized or obfuscated for security through obscurity, the scanner misinterprets the header as an unpatched release, creating a false positive. Authenticated scans or local agent audits provide accurate verification by directly checking installed software patches.
Step-by-Step Solution
Key Concept
Credentialed vs. Unauthenticated Scanning and False Positive Identification