nerdexam
(ISC)2

CISSP · Question #1202

A web developer is completing a new web application security checklist before releasing the application to production. the task of disabling unecessary services is on the checklist. Which web…

The correct answer is A. Security misconfiguration. Disabling unnecessary services reduces the attack surface of a web application, which directly addresses security misconfiguration vulnerabilities. Security misconfiguration is one of the most common OWASP Top 10 threats and includes leaving unneeded features or services enabled.

Submitted by ahmad_uae· Mar 5, 2026Software Development Security

Question

A web developer is completing a new web application security checklist before releasing the application to production. the task of disabling unecessary services is on the checklist. Which web application threat is being mitigated by this action?

Options

  • ASecurity misconfiguration
  • BSensitive data exposure
  • CBroken access control
  • DSession hijacking

How the community answered

(44 responses)
  • A
    80% (35)
  • B
    11% (5)
  • C
    5% (2)
  • D
    5% (2)

Why each option

Disabling unnecessary services reduces the attack surface of a web application, which directly addresses security misconfiguration vulnerabilities. Security misconfiguration is one of the most common OWASP Top 10 threats and includes leaving unneeded features or services enabled.

ASecurity misconfigurationCorrect

Security misconfiguration occurs when systems are not securely configured, including leaving unnecessary services, ports, or features enabled. Disabling unused services eliminates potential entry points that attackers could exploit, directly mitigating this OWASP Top 10 category. This is a proactive hardening measure that reduces the overall attack surface of the application.

BSensitive data exposure

Sensitive data exposure relates to improper protection of data at rest or in transit (e.g., missing encryption), not to whether unnecessary services are running.

CBroken access control

Broken access control refers to failures in enforcing user permissions and authorization policies, which is unrelated to the enabling or disabling of services.

DSession hijacking

Session hijacking involves an attacker stealing or forging a valid session token to impersonate a user, which is not addressed by disabling unnecessary services.

Concept tested: OWASP security misconfiguration and attack surface reduction

Source: https://owasp.org/Top10/A05_2021-Security_Misconfiguration/

Topics

#Web application security#Security misconfiguration#Attack surface reduction#OWASP Top 10

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CISSP Practice