Study. uk . com
  1. Home
  2. All questions
  3. Question 473

CISSP study material · question 473 of 500

A team plans to fix an insecure design by improving code review and static analysis. Why does OWASP say this will not work?

  1. Code review cannot detect defects in third-party libraries.
  2. An insecure design cannot be fixed by a perfect implementation, because the needed control was never created.
  3. Design flaws are always in configuration rather than code.
  4. Static analysis reports design flaws only where source is available for every component.
Show the answer

Answer: B. An insecure design cannot be fixed by a perfect implementation, because the needed control was never created.

OWASP distinguishes design flaws from implementation defects, and states an insecure design cannot be fixed by a perfect implementation because the security controls needed were never created.

Source: OWASP Top 10 A06:2025 (OWASP) — OWASP Top 10:2025 A06 Insecure Design > Description

Challenge yourself on this topic → Study as cards