Although a vulnerability scan report shows no vulnerabilities have been discovered, a subsequent
penetration test reveals vulnerabilities on the network. Which of the following has been reported by the
vulnerability scan?

A.
Passive scan

B.
Active scan

C.
False positive

D.
False negative

Explanation:
With a false negative, you are not alerted to a situation when you should be alerted. A False negative is
exactly the opposite of a false positive.
Incorrect Answers:
A: A vulnerability scan does not report a passive scan. In fact it is the actual performance of the scan.
B: A vulnerability scan does not report an active scan. It is the actual scanning.
C: False positives are essentially events that are mistakenly flagged and are not really events to be
concerned about.

Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, 6th Edition, Sybex, Indianapolis,
2014, pp. 28, 52
http://www.cgisecurity.com/questions/falsepositive.shtml