Exercise 3: Why a Pattern Match Isn't a Confirmed Vulnerability — Possible Solution
====================================================================

THE CHAPTER'S OWN WARN-BOX
------------------------------
Per this chapter, "finding an attack-surface element that superficially
resembles a known vulnerability class doesn't confirm the vulnerability
is actually real or exploitable — a login form might already be
protected by rate limiting and MFA; a reflected input might already be
properly encoded. This phase produces candidates, not confirmed
findings."

WHY A SURFACE-LEVEL MATCH ISN'T PROOF
------------------------------
This phase (Vulnerability Analysis) works by recognizing that a
discovered piece of attack surface RESEMBLES a known vulnerability
class — for example, a login form resembling the kind of feature bc1
covers, or a reflected input resembling the pattern xss1 describes.
But resemblance to a vulnerable PATTERN is not the same as confirming
that THIS SPECIFIC instance is actually vulnerable. The chapter's own
examples make this concrete: a login form might look like a candidate
for brute-force weakness, but could already have rate limiting and MFA
in place, making it not actually exploitable despite matching the
general pattern. Likewise, a reflected input might look like an XSS
candidate, but could already be properly output-encoded, defeating the
attack despite superficially matching the vulnerability class.

WHERE THIS GAP ACTUALLY GETS CLOSED
------------------------------
Per this chapter, "pentest1-7 is specifically about actually proving
impact for a candidate, rather than assuming impact from a
surface-level resemblance alone." pentest1-7 is the chapter that
takes this phase's own candidates and actually attempts real
exploitation to confirm — hands-on — whether the resemblance to a
known vulnerability class translates into a genuine, demonstrable
weakness, rather than treating a plausible-looking match as if it were
already a proven finding.

WHY THIS WORKS AS AN ANSWER
------------------------------
It explains the specific mechanism by which a pattern match can be
wrong (an existing mitigation the pattern-matching process doesn't
account for), using both of the chapter's own named examples, and
correctly names pentest1-7 as the exact chapter where confirmation
actually happens, rather than treating "further testing" as a vague
generality.