A municipal scanner flags a TLS configuration issue on an internal tool that manual review shows is a false positive. What should the tester do before delivering the finding as confirmed?

If a municipal scanner flags a TLS issue that manual review shows is a false positive, the tester must manually validate and either remove or clearly mark it so the client deliverable is accurate. Copying scanner text unchanged into the executive summary as critical risk misleads leadership. Increasing scanner intensity until the false positive spreads does not create truth. Blaming a TLS library vendor and closing without notes abandons professional analysis. Exam caveat: record how validation was performed so the city can reproduce the false-positive determination. Operational check: retest with independent TLS inspection, compare to actual cipher/protocol configuration, demote or remove the false positive, and keep a short validation note in the working papers. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services.