In security scanning, which term describes a finding that is not reported when it should be?

In security scanning, which term describes a finding that is not reported when it should be?

• A. False positives
• B. CVE
• C. False negatives
• D. EF

Answer: (C)

Missing a real vulnerability in a security scan is false negative. When the scanner fails to report an issue that actually exists, the vulnerability remains unaddressed, creating a hidden risk because defenses aren’t alerted to remediate it. This contrasts with false positives, where the scan flags something as a vulnerability that isn’t real, wasting time on non-issues. A CVE is simply a catalog identifier for a known vulnerability, not a term describing whether findings are reported. EF isn’t a standard term used to describe this reporting behavior.

Missing a real vulnerability in a security scan is false negative. When the scanner fails to report an issue that actually exists, the vulnerability remains unaddressed, creating a hidden risk because defenses aren’t alerted to remediate it. This contrasts with false positives, where the scan flags something as a vulnerability that isn’t real, wasting time on non-issues. A CVE is simply a catalog identifier for a known vulnerability, not a term describing whether findings are reported. EF isn’t a standard term used to describe this reporting behavior.