QuestionA security analyst is performing a penetration test on an organization’s internal network.

Explanation (ISO-aligned)

Vulnerability scanning tools may produce false positives.

ISO/IEC 27002:2022 A.8.8 (Management of technical vulnerabilities) requires vulnerabilities to be evaluated, not blindly accepted.

A vulnerability becomes confirmed only after validation, contextual analysis, or successful exploitation.

Option A is incorrect because scan results require validation.

Option B is incorrect because failure to exploit does not prove absence of vulnerability.

✅ Correct reasoning: risk must be validated before confirmation.