nerdexam
(ISC)2

CCSP · Question #279

The Open Web Application Security Project (OWASP) Top Ten is a list of web application security threats that is composed by a member-driven OWASP committee of application development experts and…

The correct answer is D. Perform periodic scans and audits of the environment. To reduce the risk of security misconfigurations, regular scans and audits are essential to identify and rectify vulnerabilities in the environment.

Submitted by saadiq_pk· Apr 18, 2026Cloud Security Operations

Question

The Open Web Application Security Project (OWASP) Top Ten is a list of web application security threats that is composed by a member-driven OWASP committee of application development experts and published approximately every 24 months. The 2013 OWASP Top Ten list includes "security misconfiguration." Which of these is a technique to reduce the potential for a security misconfiguration? Response:

Options

  • AGet regulatory approval for major configuration modifications.
  • BUpdate the BCDR plan on a timely basis.
  • CTrain all users on proper security procedures.
  • DPerform periodic scans and audits of the environment.

How the community answered

(58 responses)
  • A
    3% (2)
  • B
    5% (3)
  • C
    9% (5)
  • D
    83% (48)

Why each option

To reduce the risk of security misconfigurations, regular scans and audits are essential to identify and rectify vulnerabilities in the environment.

AGet regulatory approval for major configuration modifications.

Getting regulatory approval for modifications is a governance step, not a technical control to prevent misconfigurations.

BUpdate the BCDR plan on a timely basis.

Updating the Business Continuity and Disaster Recovery (BCDR) plan focuses on recovery and resilience, not the prevention of initial security misconfigurations.

CTrain all users on proper security procedures.

Training users on security procedures primarily addresses human error in daily operations, not system-level configuration errors.

DPerform periodic scans and audits of the environment.Correct

Performing periodic scans and audits of the environment directly addresses security misconfigurations by identifying deviations from secure baselines, incorrect permissions, unnecessary services, or unpatched systems. This proactive approach allows organizations to detect and correct misconfigurations before they can be exploited.

Concept tested: Reducing security misconfiguration through auditing

Source: https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2013/

Topics

#OWASP Top Ten#Security Misconfiguration#Vulnerability Management#Security Auditing

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CCSP Practice