Which of the following should the administrator do to verify if this is indeed a false positive?

An assessment too reports that the company’s web server may be susceptible to remote buffer
overflow. The web server administrator insists that the finding is a false positive. Which of the
following should the administrator do to verify if this is indeed a false positive?

A.
Use a banner grabbing tool

B.
Run a vulnerability scan

C.
Enforce company policies

D.
Perform a penetration test