Scenario: A data processing tool crashed when a user added more data to the buffer than its storage capacity allows. The incident was caused by the tool's inability to bound-check arrays. What kind…

Question

Options

• AIntrinsic vulnerability, i.e., inability to bound-check arrays, is a characteristic of the data processing
• BExtrinsic vulnerability, i.e., the exploit of the buffer overflow vulnerability, is caused by an external
• CNone; buffer overflow is not a vulnerability; it is a threat

• A
  89% (24)
• B
  7% (2)
• C
  4% (1)

Explanation

Intrinsic vulnerabilities are inherent flaws in a system, software, or tool. In this case, the inability to bound-check arrays is an inherent weakness of the software, making it an intrinsic vulnerability. This aligns with ISO/IEC 27001:2022 Annex A Control A.8.9 (Configuration Management), which mandates secure software design and validation practices. Extrinsic vulnerabilities arise due to external factors (e.g., misconfigurations or lack of security patches). Buffer overflow is a vulnerability, not a threat, because it represents a weakness that can be exploited by an attacker.

No community discussion yet for this question.