A municipal scanner flags a TLS configuration issue on an internal tool that manual review shows is a false positive. What should the tester do before delivering the finding as confirmed?
Select an answer to reveal the explanation.
Short Explanation
Scanners cry wolf sometimes. Double-check with your own eyes before you put it in the report—clients should not chase ghosts.
Full Explanation
Automated scanners produce false positives that waste remediation effort if reported as confirmed. Manual validation—and clear labeling or removal of unverified noise—is part of professional vulnerability assessment. Deliverables must distinguish confirmed issues from tool output.