During a routine vulnerability assessment, a security analyst reviews scan results targeting an internal web server farm behind a reverse proxy. The report highlights several high-severity remote code execution vulnerabilities based on outdated software version headers. However, an authenticated system audit confirms that security patches were fully applied and the underlying software was patched out-of-band without updating the exposed service header strings. Which of the following best explains why the vulnerability scanner reported these vulnerabilities?
- The scanner produced false positives due to relying on non-credentialed banner grabbing rather than local inspection.Cevap
- BThe network firewall failed to act as a compensating control to suppress the scanner payload.
- CThe detective controls on the host misclassified administrative logins as malicious activity.
- DCross-site scripting (XSS) scripts intercepted the scanner probes and altered database responses.
Cevap
The vulnerability scanner generated false positives because it performed a non-credentialed scan that relied strictly on external banner grabbing, which failed to reflect internal patch state.
Non-credentialed vulnerability scans rely on remote inspection techniques such as banner grabbing. When operating system or application updates patch vulnerabilities without updating version headers, unauthenticated scanners misidentify host status and generate false positives. Performing credentialed scans resolves this by inspecting local software packages and file versions directly.
Adım Adım Çözüm
Anahtar Kavram
Credentialed vs. Non-Credentialed Vulnerability Scanning and False Positives