A vulnerability scan that identifies a vulnerability that is actually exploitable is called what?

• A. False negative
• B. True negative
• C. True positive
• D. False positive

Answer: (C)

When evaluating vulnerability findings, the key idea is whether the scanner’s finding matches reality in terms of exploitability. If the scanner identifies a vulnerability and that vulnerability is actually exploitable in the real environment, that result is a true positive. It means the tool correctly detected a real risk that an attacker could potentially exploit under the right conditions.

By contrast, a false positive would be a reported vulnerability that isn’t actually exploitable, a false negative would be an exploitable vulnerability that the scanner missed, and a true negative would be no vulnerability found and no exploitable risk present.