The ASV is REQUIRED to investigate false positives with a CVSS Base score at or below 3.9 (a passing score).

• A. True
• B. False
• C. Not specified
• D. Not applicable

Answer: (B)

CVSS scores are used to prioritize which vulnerabilities need careful validation and remediation. In the PCI ASV process, the focus is on higher-severity findings, since those pose a greater risk to cardholder data. Low-severity results (base score 3.9 or below) are considered lower risk, so the formal requirement to investigate potential false positives is not applied to those passing-score items. In other words, false positives with a CVSS base score at or below 3.9 are not mandated to be investigated by the ASV as part of the standard practice. This is why the statement is not correct.