CyberCertPrepWeb App FundamentalsCommon Web Vulnerabilities (OWASP Intro)EASYFree question
What OWASP Top 10 2021 category covers the risk of developers assuming features/frameworks are secure by default without verifying the configuration?
- A.A01: Broken Access Control
- B.A05: Security Misconfiguration
- C.A04: Insecure Design
- D.A07: Identification and Authentication Failures
Why B is correct
A05:2021 Security Misconfiguration includes leaving defaults in place (default passwords, sample applications), enabling unnecessary features, overly permissive CORS, verbose error messages, and not hardening the stack. The assumption that frameworks are 'secure by default' without reviewing the actual configuration is a primary cause of this category.
Know someone studying for Web App Fundamentals? Send them this one.