CISSP Software Development Security Practice Question
During a security assessment, a penetration tester discovers that a web application exposes internal IP addresses in error messages. Which vulnerability category does this represent?
⚠ Common exam trap
A common mix-up: candidates confuse the disclosure of internal IP addresses with 'sensitive data exposure' (B), but CISSP categorizes this under security misconfiguration because the root cause is a failure to properly configure error handling, not the inherent sensitivity of the data itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security misconfiguration
Exposing internal IP addresses in error messages is a classic example of a security misconfiguration (C). The web application is likely configured to output detailed error messages (e.g., stack traces or debug information) that include internal network details, which should be suppressed in production environments. This violates the principle of least information disclosure and is categorized under security misconfiguration because it stems from improper default or runtime settings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Broken access control
Why it's wrong here
Broken access control refers to vulnerabilities where an application fails to properly restrict authenticated users from accessing unauthorized resources or performing unauthorized actions. While verbose error messages reveal information, they do not inherently bypass authorization logic or grant access to functionality or data that would otherwise be protected by access control mechanisms. The issue is information disclosure, not a failure in access enforcement.
- ✗
Sensitive data exposure
Why it's wrong here
Sensitive data exposure typically involves the direct leakage of confidential information, such as personally identifiable information (PII), financial data, or credentials, often due to inadequate protection during storage or transit. Although an internal IP address can be considered sensitive reconnaissance data, the primary vulnerability here is not the inherent lack of protection for the data itself, but rather the application's misconfigured behavior of revealing internal system details through verbose error messages.
- ✓
Security misconfiguration
Why this is correct
Security misconfiguration is the correct classification because verbose error messages, which reveal internal IP addresses and potentially other system details like software versions or stack traces, are a direct result of improper system hardening. Production environments should be configured to suppress such detailed output, presenting only generic error messages to end-users. This prevents attackers from gathering valuable reconnaissance information that could facilitate further targeted attacks.
- ✗
Insecure deserialization
Why it's wrong here
Insecure deserialization occurs when an application deserializes untrusted data without proper validation, leading to potential remote code execution, denial-of-service, or other attacks by manipulating object structures. The discovery of verbose error messages, while a significant security flaw, does not involve the processing of serialized data or the exploitation of object deserialization vulnerabilities; it is an information leakage issue stemming from configuration, not data processing.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security assessment
A security assessment is a systematic evaluation of an organization’s systems, networks, and applications to identify vulnerabilities, threats, and risks, and to recommend improvements.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.