Study. uk . com
  1. Home
  2. All questions
  3. Question 498

CISSP study material · question 498 of 500

An application writes full patient records into its application log and shows recent log lines on an administrative page any authenticated user can open. Which two failures does OWASP identify? Choose two.

  1. Failing to encode the log data before writing it.
  2. Logging sensitive information such as personal or health data that should not be logged.
  3. Showing log and alert events to a user, or to an attacker.
  4. Failing to roll back the transaction that produced the entry.
Show the answer

Answer: B. Logging sensitive information such as personal or health data that should not be logged.
C. Showing log and alert events to a user, or to an attacker.

Two failures appear here: private records written into the log at all, and log or alert content shown to whoever opens the page.

Source: OWASP Top 10 A09:2025 (OWASP) — OWASP Top 10:2025 A09 Security Logging and Alerting Failures > Description

Challenge yourself on this topic → Study as cards