Study. uk . com
  1. Home
  2. All questions
  3. Question 497

CISSP study material · question 497 of 500

Why does OWASP require log data to be correctly encoded before it is written?

  1. Otherwise sensitive data will be written in a recoverable form.
  2. Otherwise an attacker can inject into the logging or monitoring system itself, turning the audit trail into an attack path.
  3. Otherwise the entries cannot be compared against a message digest.
  4. Otherwise the log management system cannot parse entries into fields.
Show the answer

Answer: B. Otherwise an attacker can inject into the logging or monitoring system itself, turning the audit trail into an attack path.

OWASP lists vulnerability to injections or attacks on the logging or monitoring systems where log data is not correctly encoded, and asks that encoding prevent such attacks.

Source: OWASP Top 10 A09:2025 (OWASP) — OWASP Top 10:2025 A09 Security Logging and Alerting Failures > Description

Challenge yourself on this topic → Study as cards