A scanner flags a supposedly vulnerable version, but a vendor backport patched it. What should the analyst do?

1. Suppress every future finding from that host
2. Validate the finding using reliable patch evidence
3. Reinstall immediately without checking
4. Publish the host's credentials to the scanner vendor