CISSP Software Development Security Practice Question
A security engineer is evaluating a web application for common vulnerabilities. The application uses a Content Management System (CMS) that is outdated and has known vulnerabilities. Additionally, the application displays detailed error messages and uses default administrative credentials. Which TWO of the following OWASP Top 10 categories are most relevant to these issues?
⚠ Common exam trap
Candidates may incorrectly associate default credentials with Broken Access Control, but these are a security misconfiguration. The outdated CMS is clearly Vulnerable and Outdated Components.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Vulnerable and Outdated Components
A is correct because the outdated CMS with known vulnerabilities directly corresponds to OWASP A06:2021 – Vulnerable and Outdated Components. This category covers using software versions with unpatched security flaws, which attackers can exploit via public exploit databases or automated scanners. B is correct because displaying detailed error messages and using default administrative credentials are classic examples of Security Misconfiguration (OWASP A05:2021). This occurs when security settings are not properly defined, implemented, or maintained, allowing attackers to gain information or unauthorized access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Vulnerable and Outdated Components
Why this is correct
Vulnerable and Outdated Components refers to the risk posed by using software components, such as libraries, frameworks, and other modules, that have known security flaws or are no longer supported. Exploiting these vulnerabilities, often documented as Common Vulnerabilities and Exposures (CVEs), can grant attackers unauthorized access, data breaches, or system control. Regularly updating and patching all third-party components is crucial to mitigate this significant attack vector.
- ✓
Security Misconfiguration
Why this is correct
Security Misconfiguration encompasses a broad range of issues stemming from improperly configured security settings across the application stack, including web servers, application servers, databases, and frameworks. This often involves using default credentials, leaving unnecessary features enabled, having verbose error messages that disclose sensitive information, or failing to implement proper security hardening. Such misconfigurations create easily exploitable entry points for attackers.
- ✗
Injection
Why it's wrong here
Injection vulnerabilities occur when untrusted data is sent to an interpreter as part of a command or query, tricking the interpreter into executing unintended commands or accessing unauthorized data. This category includes SQL Injection, NoSQL Injection, OS Command Injection, and Cross-Site Scripting (XSS), where malicious input manipulates the application's underlying logic or data interactions. It specifically targets how an application processes and executes user-supplied input.
- ✗
Cryptographic Failures
Why it's wrong here
Cryptographic Failures involve the improper implementation or absence of cryptographic protections, leading to the exposure of sensitive data. This can manifest as using weak or deprecated algorithms, insufficient key lengths, improper key management, or failing to encrypt data at rest or in transit when required. Such failures directly compromise the confidentiality and integrity of protected information, making it readable or modifiable by unauthorized parties.
- ✗
Broken Access Control
Why it's wrong here
Broken Access Control refers to the improper enforcement of restrictions on what authenticated users are allowed to do, allowing them to bypass authorization checks. This can enable users to access other users' accounts, view sensitive files, modify data, or perform administrative functions without proper permissions. Flaws often arise from incorrect role-based access control (RBAC) implementations or insufficient validation of user requests against their assigned privileges.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Security misconfiguration
Security misconfiguration occurs when security settings are defined, implemented, or maintained incorrectly, leaving systems, applications, or networks vulnerable to unauthorized access or data breaches.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.