A scanner identifies a vulnerability using an application banner, but the vendor's maintained package includes a backported fix. What is the best disposition?

1. Validate the vendor build and document a false positive if supported
2. Patch unrelated software until the report disappears
3. Exploit the host without approval to settle the question
4. Mark the entire host permanently exempt from all checks