Which term describes security vulnerabilities due to insecure or misconfigured servers or apps?

Which term describes security vulnerabilities due to insecure or misconfigured servers or apps?

• A. Bug bounty program
• B. RASP
• C. Security misconfiguration
• D. URL blacklisting

Answer: (C)

Security misconfiguration describes vulnerabilities that arise from insecure or misconfigured servers or applications. When settings are left at defaults, unnecessary services are enabled, verbose error messages expose details, or permissions and headers aren’t tightened, attackers can exploit these missteps to gain access or escalate privileges. This category covers issues like default credentials, debug modes active in production, and overly permissive cloud storage or access controls. It’s about how the system is configured, rather than flaws in the code itself. The other terms refer to different concepts: a bug bounty program is a rewards program for finding flaws, RASP is a defensive technology that monitors and blocks attacks within an application, and URL blacklisting is a blocking mechanism to prevent access to known bad sites.

Security misconfiguration describes vulnerabilities that arise from insecure or misconfigured servers or applications. When settings are left at defaults, unnecessary services are enabled, verbose error messages expose details, or permissions and headers aren’t tightened, attackers can exploit these missteps to gain access or escalate privileges. This category covers issues like default credentials, debug modes active in production, and overly permissive cloud storage or access controls. It’s about how the system is configured, rather than flaws in the code itself. The other terms refer to different concepts: a bug bounty program is a rewards program for finding flaws, RASP is a defensive technology that monitors and blocks attacks within an application, and URL blacklisting is a blocking mechanism to prevent access to known bad sites.