Which statement about investigating false positives with CVSS Base score >= 4.0 is true?

Which statement about investigating false positives with CVSS Base score >= 4.0 is true?

• A. Optional
• B. Prohibited
• C. Not specified
• D. Required to investigate

Answer: (D)

The core idea is that findings from an external vulnerability scan with a CVSS base score of 4.0 or higher must be validated to confirm whether they’re real or false positives. This threshold marks moderate to high risk, so it’s important not to accept the report at face value. Investigating false positives in this scenario ensures you don’t miss genuine issues or waste effort chasing non-existent ones, and it provides solid evidence about the actual risk and whether remediation is needed. That’s why the correct stance is that you are required to investigate. The other options don’t fit because PCI ASV practices mandate active validation, not optional, prohibited, or unspecified handling of these findings.

The core idea is that findings from an external vulnerability scan with a CVSS base score of 4.0 or higher must be validated to confirm whether they’re real or false positives. This threshold marks moderate to high risk, so it’s important not to accept the report at face value. Investigating false positives in this scenario ensures you don’t miss genuine issues or waste effort chasing non-existent ones, and it provides solid evidence about the actual risk and whether remediation is needed. That’s why the correct stance is that you are required to investigate. The other options don’t fit because PCI ASV practices mandate active validation, not optional, prohibited, or unspecified handling of these findings.