Study. uk . com
  1. Home
  2. All questions
  3. Question 489

CISSP study material · question 489 of 500

A team serialises user state and passes it back and forth with each request to keep their services stateless. Which risk does OWASP's integrity failures entry identify?

  1. Cryptographic failure, where the serialised structure is transmitted without encryption.
  2. Insecure deserialisation, where an attacker who can see and modify the serialised structure may reach remote code execution.
  3. Broken access control, where the serialised state names another user's records.
  4. Session fixation, where the attacker reuses the serialised identifier.
Show the answer

Answer: B. Insecure deserialisation, where an attacker who can see and modify the serialised structure may reach remote code execution.

Data serialised into a structure an attacker can see and alter is open to insecure deserialisation, whose illustration reaches remote code execution on the server.

Source: OWASP Top 10 A08:2025 (OWASP) — OWASP Top 10:2025 A08 Software or Data Integrity Failures > Description

Challenge yourself on this topic → Study as cards