mediumMultiple ChoiceObjective-mapped
CISA Practice Question: An IS auditor is reviewing the configuration for…
Exhibit
Refer to the exhibit. [WebApp] BaseURL = https://app.example.com AuthMethod = Basic SessionTimeout = 600 Encryption = SSL
An IS auditor is reviewing the configuration for a web application. Which of the following is the MOST significant security weakness?
⚠ Common exam trap
The trap here is that candidates often focus on the deprecated SSL protocol (Option D) as the most significant weakness, overlooking that Basic authentication exposes credentials in a trivially reversible format regardless of the transport layer security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The authentication method is Basic
Basic authentication transmits credentials in Base64-encoded plaintext over the network, which is trivially decoded and captured by any attacker with access to the traffic. Even when used over HTTPS, the credentials are exposed in the browser's cache and server logs, making this the most significant weakness among the options.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The authentication method is Basic
Why this is correct
Basic authentication sends credentials in plain text if not over TLS; even with TLS, it's weaker than digest or certificate-based.
- ✗
Session timeout is set to 600 seconds (10 minutes)
Why it's wrong here
While high, it is not as critical as weak authentication.
- ✗
The base URL uses HTTPS
Why it's wrong here
HTTPS is secure; this is not a weakness.
- ✗
Encryption uses SSL instead of TLS
Why it's wrong here
SSL is deprecated but still provides encryption; basic auth is a bigger risk.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.