Answer is A. It was a vulnerablity scan. The server was flagged for being vulernable TO an Apache Struts exploit. The developer that was responsible for THAT server informs Security it is NOT installed. The vulnerabiltiy is not there. The scan was a false positive (meaning it detected something that really wasn't there).

What EVER you do, do not listen to day95! In fact, I would put an implict DENY on all his/her opinions... wth does he mean "initial server doesnt have apache"? The damn developer said it dont have the "STRUTS" module...JEEZ

Unfortunately, vulnerability scanners aren’t perfect. Occasionally, they report a vulnerability when it doesn’t actually exist. In other words, the scan indicates a system has a known vulnerability, but the report is false. As an example, a vulnerability scan on a server might report that the server is missing patches related to a database application, but the server doesn’t have a database application installed (Darril Gibson’s Get Certified Get Ahead p. 574).

We have to first question the vulnerability scan that was done, then verify if Apache was truly installed or not then before we decide to quarantine. In a real-life scenario, this would have been the case. Option A is not a good step to take at all and option D alike. So in a sense, for best practice regarding security intelligence, eliminating all options presented, I'd go for option D with caution 'cos you don't neglect a security issue.

It is a false positive as vulnerability scans can cause many false positives as per the "get certified get ahead". you can use credentialed scans to reduce false positives.

Answer is D. If you're sure that on the server Apache is not installed, and with a scan you find "Apache is not updated" well... that's a problem.

Agree that answer is A. An exploit is moot if the designated target does not have any means for the potential exploit to function in the first place, and would be a waste of time and resources to address a potential threat if the threat has no means to take advantage of required vulnerability.

The answer is not A, it is D because initially the server did not have apache, so malware infected the server and is referencing apache somehow. If the server did have apache initially, it would be a false positive if an anaylst went deeper into the problem and found nothing.

The answer is A false positive