During a routine security audit, analysts discover several web servers still use a vulnerable third- party library flagged for a zero-day exploit. The vulnerability was identified previously and…

Question

Options

• ASoftware and data integrity failures
• BSecurity logging and monitoring failures
• CVulnerable and outdated components
• DInsecure design

• A
  8% (2)
• B
  4% (1)
• C
  88% (23)

Explanation

This is best classified as “Vulnerable and outdated components” because the organization is knowingly running a third-party library with a known exploitable vulnerability and has rolled back the available fix. In web application security, third-party dependencies are a major risk driver because attackers routinely target widely used frameworks and libraries, especially when exploit code becomes available or active exploitation is observed. Even if the rollback was motivated by stability, disabling vulnerable functionality, strict input validation, segmentation) maintains high risk. Software and data integrity failures would focus on unauthorized changes or untrusted code deployment; the issue here is the presence of a known vulnerable dependency. Security logging/monitoring failures refer to insufficient visibility, not the root exposure. Insecure design refers to architectural weaknesses built into the application; while dependency management can be part of secure design, the immediate classification is the vulnerable component itself. From a SOC perspective, this classification drives remediation: prioritize patch-compatible fixes, upgrade dependency versions, implement compensating controls until patching is possible, and improve change management to prevent security rollback without risk acceptance and mitigation.

No community discussion yet for this question.