True or False, Positive or Negative?

About this interactive

The Vulnerability Validation lesson builds four states from two questions. Positive or negative: does the vulnerability show up on the report? Positive means it is reported; negative means it is not. True or false: is the report accurate? True means the report matches the system; false means it does not. True positive: reported, and really there. False positive: reported, but not really there. True negative: not reported, and not there. False negative: not reported, but really there, which is the dangerous one because nobody goes looking. Validating findings weeds out false positives, and a false negative or a false positive is a reason to tune the scanner. A quick test for each card: first, does the report show it? Then, does the check of the system agree?

What you'll learn

Classify a scan result as a true positive, false positive, true negative or false negative by comparing what the report says with what is really on the system
Recognize that positive means the report shows the vulnerability and true means the report is right

Aligned to

CompTIA Security+

4.3 Explain various activities associated with vulnerability management.

CompTIA CySA+

2.2 Given a scenario, analyze output from vulnerability assessment tools.

Key terms

True Positive: A scan result that correctly identifies a vulnerability that actually exists on the system.
False Positive: An alert that fires when no actual issue exists, which over time can cause administrators to ignore notifications and reduce monitoring effectiveness.
True Negative: A scan result that correctly reports no vulnerability when none exists on the system.
False Negative: A failure to generate an alert when a real issue exists, leaving problems undetected and unaddressed.
Vulnerability Assessment: The process of identifying, quantifying, and prioritizing vulnerabilities in a system.

Topics

Vulnerability Management Validation Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →