CISSP Software Development Security Practice Question
During a vulnerability assessment, a security analyst discovers that a web application uses a library known to be vulnerable to Log4Shell (CVE-2021-44228). Which type of vulnerability does this represent?
⚠ Common exam trap
CISSP often tests the confusion between 'the app has a bug' and 'the app uses a buggy library' — candidates pick SSRF or deserialization because Log4Shell's exploit path resembles those, missing that the vulnerability classification is about the component, not the attack technique.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Vulnerable components
Log4Shell (CVE-2021-44228) is a remote code execution flaw in the Apache Log4j 2 library's JNDI lookup feature. Because the vulnerability resides in a third-party dependency that the application includes, it is classified under OWASP Top 10 A06:2021 — Vulnerable and Outdated Components. The application code itself may be fine; the risk comes from the library version it ships with.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Server-side request forgery (SSRF)
Why it's wrong here
Server-side request forgery (SSRF) occurs when an attacker tricks a server-side application into making requests to an unintended location, often internal networks or other external services, on the attacker's behalf. This vulnerability typically involves manipulating URLs or request parameters to redirect the server's outgoing connections. A flaw in a logging library, such as Log4Shell, primarily concerns remote code execution through manipulated log messages and JNDI lookups, which is distinct from coercing the server to initiate arbitrary network requests.
- ✓
Vulnerable components
Why this is correct
Vulnerable components refer to weaknesses found within third-party libraries, frameworks, or modules that are integrated into an application. The Log4Shell vulnerability (CVE-2021-44228) is a quintessential example, where a critical remote code execution flaw existed within the widely used Apache Log4j logging library itself. Discovering a flaw in a logging library directly aligns with identifying a vulnerable component, as the application's security posture is compromised by a defect in one of its constituent parts.
- ✗
Insecure deserialization
Why it's wrong here
Insecure deserialization vulnerabilities arise when an application deserializes untrusted data without proper validation, allowing an attacker to manipulate serialized objects to execute arbitrary code or perform denial-of-service attacks. This exploit vector specifically targets the process of reconstructing objects from a byte stream. A logging library flaw like Log4Shell, however, exploits the JNDI lookup mechanism within log message processing, which is fundamentally different from the risks associated with reconstructing potentially malicious serialized objects.
- ✗
Security misconfiguration
Why it's wrong here
Security misconfiguration involves flaws in the setup or configuration of an application, server, network device, or cloud service, leading to exploitable weaknesses. Examples include using default credentials, leaving unnecessary services enabled, or having overly permissive access controls. While misconfigurations can expose vulnerabilities, a flaw inherent to a logging library's code, such as Log4Shell, represents a defect in the component itself rather than an incorrect setting applied by the administrator or developer.
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Components
Key term
Vulnerability assessment
A vulnerability assessment is a systematic review of security weaknesses in an information system, evaluating if the system is susceptible to any known vulnerabilities, assigning severity levels, and recommending remediation or mitigation.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.