Question

10A As part of its SDLC, an organization scans all new applications for the OWASP Top 10 vulnerabilities. A new application shows no vulnerabilities via this process and is placed into production. An independent penetration test identifies several network layer vulnerabilities. Which of the following is the MOST likely cause? The vulnerability scanner should have utilized a credentialed scan The OWASP Top 10 does not include methods to detect this class of vulnerability The scanner cannot see the traffic used by the application because it is configured to use SSL/TLS. The application is not subject to PCI, so it does not need to be scanned at the network layer OB D

Answer 1

Option B is the right one.

Individual Penetration test is the test used to identify the vulnerabilities in the application. This test will identify the vulnerabilities and try to exploit those.

OWSAP is open web security application project. This is the non profit organization which is used to provide accurate information about the security of the application. It will identify 10 vulnerabilities like injection, broken authentication, sensitive data exposure, etc..,

In the given statement, the organization has not detected any vulnerability in the new app because it may not have specific method or class to check the vulnerability.

So, independent penetration test have identified many vulnerabilities which have all methods or classes to identify those vulnerabilities.

Hence, option B is the right one, where it doesn't have methods of class to identify vulnerabilities.

-------

Comment for any doubts. Upvote if u like it.

Thank you.