An agent uses an automated security scanner as a quality gate before completing any pull request. The team reports that the scanner flags 40% of the agent's PRs as policy violations, but manual review shows the vast majority of flagged items are false positives — legitimate code patterns that the scanner incorrectly identifies as risky. The agent halts unnecessarily on each flag, requiring manual clearance. What is the most appropriate response?
Select an answer to reveal the explanation.
Short Explanation and Infographic
A smoke alarm that goes off every time you cook toast doesn't make your kitchen safer — it makes people disable the alarm. That's the false positive trap: if a quality gate is too noisy, teams start working around it, and real violations slip through. The right fix is calibration: tune the scanner rules, add allow-lists for known-safe patterns, and threshold the agent's halt behavior to high-confidence violations only. The exam tests whether you know to tune tools rather than disable or blindly trust them.
Full explanation below image
Full Explanation
This question tests your understanding of how to manage automated scanning tools in an agentic workflow when the tool's signal-to-noise ratio is poor.
The correct answer is C. When an automated scanner produces a high rate of false positives, the appropriate response is calibration — not removal or wholesale bypass. This involves three parallel actions: (1) tuning the scanner's rules to be more specific and less prone to false positives on the code patterns the agent generates; (2) building an allow-list of known-safe patterns that appear frequently in the agent's legitimate output; and (3) configuring the agent's halt trigger to activate only on high-confidence, high-severity violations rather than on every flag. This preserves the security value of the scanner while eliminating the operational friction of constant false positive clearance.
Option A is incorrect. Disabling the scanner entirely removes a critical security quality gate and leaves the agent free to submit PRs with genuine policy violations. Security tooling should be calibrated, not eliminated.
Option B is incorrect and dangerous. Configuring the agent to ignore all scanner warnings because most are false positives means that when a genuine violation occurs, it will also be ignored. This is exactly the wrong trade-off — you've achieved operational efficiency at the cost of security integrity.
Option D is incorrect. No automated scanner guarantees zero false positives — this is a fundamental limitation of static analysis. The claim in the option is not achievable, and chasing it by purchasing expensive tools without addressing calibration will reproduce the same problem at higher cost. Scanner tuning is always necessary regardless of the tool's cost or reputation.
The correct approach demonstrates a key principle: evaluation and quality gate tools in agent systems must themselves be maintained and calibrated. A poorly configured gate is as dangerous as no gate, because it trains teams to ignore its outputs.