What common configuration errors can expose sensitive data? (Choose two)

Question

Options

• AStoring sensitive data in plaintext
• BEnabling the SameSite attribute for cookies
• CUsing outdated SSL/TLS protocols
• DImplementing secure authentication mechanisms

• A
  74% (23)
• B
  19% (6)
• D
  6% (2)

Explanation

Storing sensitive data in plaintext (A) is a classic misconfiguration that makes data immediately readable if a database, log file, or config file is compromised - encryption should always be applied to passwords, tokens, and PII at rest. Using outdated SSL/TLS protocols (C) exposes data in transit by relying on deprecated cryptographic standards (like SSLv3 or TLS 1.0) that have known vulnerabilities such as POODLE and BEAST, allowing attackers to intercept and decrypt communications.

Option B is wrong because enabling the SameSite attribute is a protective measure that reduces CSRF risk - it restricts how cookies are sent cross-site. Option D is also wrong because implementing secure authentication mechanisms is a security best practice, not a misconfiguration.

Memory tip: Think "plaintext + old protocols = data exposed." Both A and C involve failing to protect data - one at rest, one in transit. The distractors (B and D) are things you want to enable or implement, not avoid.

No community discussion yet for this question.