Which of the following threat types can occur when encryption is not properly applied or insecure transport mechanisms are used?

Question

Options

• ASecurity misconfiguration
• BInsecure direct object references
• CSensitive data exposure
• DUnvalidated redirects and forwards

• A
  4% (1)
• B
  4% (1)
• C
  92% (22)

Explanation

Sensitive data exposure (C) occurs when applications fail to adequately protect sensitive information - such as passwords, credit card numbers, or personal data - and encryption is the primary defense. When encryption is absent, weak, or applied to an insecure transport layer (e.g., HTTP instead of HTTPS), attackers can intercept or access that data in transit or at rest.

Why the distractors are wrong:

• A (Security misconfiguration) refers to improperly configured servers, frameworks, or cloud settings - not specifically encryption failures.
• B (Insecure direct object references) involves attackers manipulating references (like IDs in URLs) to access unauthorized resources - an access control issue, not an encryption issue.
• D (Unvalidated redirects and forwards) involves attackers abusing redirect functionality to send users to malicious sites - unrelated to encryption.

Memory tip: Think "data needs a shield" - Sensitive Data Exposure is the threat when that shield (encryption) is missing or broken. If the question mentions encryption, TLS, HTTPS, or plaintext storage of passwords, the answer is almost always Sensitive Data Exposure.

No community discussion yet for this question.