The Metasploit Framework is only an exploit-development environment and cannot launch exploits against real applications.

### Why this is right The statement is false because the framework can be used to develop and test exploit code, and it can also launch exploits against real applications. The fact that it has professional uses does not make every use safe or authorized. ### The concept Metasploit is a platform with modules that users configure and run. Some modules can cause real damage, so testing must be limited to systems covered by explicit authorization. A test network or virtual machine helps contain the effects of a test, but it does not replace permission. The framework itself is not a substitute for a security policy or a risk assessment. ### The other options - **True**: This is wrong because the material explicitly describes Metasploit as a platform for launching exploits on real-world applications, as well as for exploit development and testing. ### Watch out The phrase “not an attack tool” can be misleading if read as “cannot launch attacks.” The material distinguishes the framework’s purpose as a testing and development platform from irresponsible or unauthorized use of its capabilities. ### Terms - **Exploit development**: Creating or adapting code that takes advantage of a software weakness. - **Virtual machine**: A software-based computer that can run an operating system and applications in an isolated environment. - **Authorization**: Explicit permission to perform a specified security test. ### Remember A tool’s professional purpose does not make every use of it authorized or harmless.