An external scanner identifies a vulnerable version, but the installed vendor build contains a backported security fix. What should determine whether the finding remains valid?

1. A requirement to report every detected banner as exploitable
2. Verification of the actual build, affected feature, and vendor advisory
3. The age of the tester's laptop
4. The scanner's severity color without supporting checks