CompTIA PenTest+ Practice Test

Which of the following is NOT part of the OWASP Top 10 security risks?

1. Cross-Site Scripting

2. SQL Injection

3. Password Complexity

4. Insecure Deserialization

The correct answer is: Password Complexity

The identification of Password Complexity as not being part of the OWASP Top 10 security risks reflects an understanding of the key vulnerabilities outlined by OWASP. The OWASP Top 10 primarily focuses on vulnerabilities that arise directly from web application flaws, such as Cross-Site Scripting (XSS), SQL Injection, and Insecure Deserialization, which are all technical weaknesses that can be exploited in web applications. Password Complexity, while an important aspect of security practices for organizations, is more of a guideline for user account management rather than a direct vulnerability in the underlying code or architecture of web applications. The emphasis of the OWASP Top 10 is on vulnerabilities that can be quantified and directly addressed by developers to secure applications, while Password Complexity pertains to user policies and procedures that support application security but do not represent specific application-level vulnerabilities. Understanding this distinction helps illustrate why Password Complexity does not fit within the OWASP Top 10 framework. This knowledge is crucial for anyone preparing for the CompTIA PenTest+ certification, as it aligns with the principles of secure coding and risk management in the context of web applications.