After significant vulnerabilities and misconfigurations were found in numerous production web applications, a security manager identified the need to implement better development controls. Which of…

Question

Options

• AInput validation routines are enforced on the server side.
• BOperating systems do not permit null sessions.
• CSystems administrators receive application security training.
• DVPN connections are terminated after a defined period of time.
• EError-handling logic fails securely.
• FOCSP calls are handled effectively.

• A
  78% (25)
• B
  13% (4)
• D
  6% (2)
• F
  3% (1)

Explanation

Server-side input validation (A) and secure error-handling logic (E) are the two most directly relevant development controls for addressing web application vulnerabilities and misconfigurations. Server-side input validation ensures that all user-supplied data is sanitized and validated at the server regardless of any client-side checks, preventing injection attacks (SQL injection, XSS, command injection, and similar OWASP Top 10 vulnerabilities). Failing securely in error handling ensures that when exceptions occur, the application does not leak sensitive technical details (stack traces, database schema, internal file paths, or connection strings) that attackers could use to refine further attacks. The remaining options-OS null sessions (B), VPN timeouts (D), administrator training (C), and OCSP handling (F)-do not directly address the root causes of web application vulnerabilities and misconfigurations.

No community discussion yet for this question.