An attacker can obtain sensitive data like credit card numbers from the database because encryption is weak or improperly implemented. This vulnerability is known as:

An attacker can obtain sensitive data like credit card numbers from the database because encryption is weak or improperly implemented. This vulnerability is known as:

• A. XML External Entity Attack
• B. Password Exploitation
• C. Sensitive Data Exposure
• D. Insecure Direct Object References

Answer: (C)

When sensitive data stored in a database isn’t protected properly because encryption is weak or misimplemented, data can be exposed to attackers who access the database or intercept the data in transit. This situation is called Sensitive Data Exposure. It covers problems like using outdated or weak cryptographic algorithms, poor key management (such as hard-coded or reused keys), incomplete encryption of data at rest or in transit, or incorrect implementation that leaves data readable in plaintext. In this scenario, the root issue is the insufficient protection of sensitive data due to weak or improperly implemented encryption, which directly leads to leakage of credit card numbers from the database—classic Sensitive Data Exposure. The other options describe different security flaws: XML External Entity attacks exploit XML parsers to access local resources or cause SSRF; Password Exploitation focuses on stealing or cracking credentials rather than broad data leakage; Insecure Direct Object References involve unauthorized access to objects via direct references, which is an access-control issue rather than encryption weakness.

When sensitive data stored in a database isn’t protected properly because encryption is weak or misimplemented, data can be exposed to attackers who access the database or intercept the data in transit. This situation is called Sensitive Data Exposure. It covers problems like using outdated or weak cryptographic algorithms, poor key management (such as hard-coded or reused keys), incomplete encryption of data at rest or in transit, or incorrect implementation that leaves data readable in plaintext.

In this scenario, the root issue is the insufficient protection of sensitive data due to weak or improperly implemented encryption, which directly leads to leakage of credit card numbers from the database—classic Sensitive Data Exposure.

The other options describe different security flaws: XML External Entity attacks exploit XML parsers to access local resources or cause SSRF; Password Exploitation focuses on stealing or cracking credentials rather than broad data leakage; Insecure Direct Object References involve unauthorized access to objects via direct references, which is an access-control issue rather than encryption weakness.