CREST Practitioner Security Analyst (CPSA) Practice

Which of the following is NOT considered a common web server flaw?

1. Buffer overflow attacks

2. Missing encryption

3. Denial of Service (DoS)

4. Attacks on vulnerable scripts

The correct answer is: Missing encryption

The answer highlights that "missing encryption" is not typically classified as a common web server flaw because it primarily relates to the transmission of data rather than a vulnerability inherent in the functioning of the web server itself. While missing encryption is a significant security concern, especially for protecting data in transit and preserving confidentiality, it is more about the implementation of security protocols rather than a flaw in the server's architecture or functionality. In contrast, buffer overflow attacks, denial of service (DoS), and attacks on vulnerable scripts directly relate to vulnerabilities or weaknesses within the server's operation or the scripts it runs. These forms of attacks exploit specific flaws in the server's code or configuration and can lead to unauthorized access, server crashes, or other security breaches. Thus, missing encryption stands out as a different category of security issue that does not fit the common flaws that manifest directly due to the server's internal processes or its software configuration.