Question

A security analyst receives a vulnerability scan report indicating that a web server is vulnerable to CVE-2021-44228 (Log4Shell). However, the analyst confirms that the server runs Apache web server version 2.4.51 without any Java components or Log4j libraries installed. What should the analyst do next?

Accepted Answer

Mark the finding as a false positive and document the rationale in the vulnerability management system

Answer

Apply compensating controls by implementing network segmentation to isolate the web server

Answer

Request an exception from management since the vulnerability cannot be immediately patched

Answer

Schedule the server for immediate patching during the next maintenance window