Câu 55: 312-39V2: Certified SOC Analyst (CSA) v2

During a routine security audit, analysts discover that several of the organization's web servers are still using a vulnerable third-party library flagged for a zero-day exploit. This vulnerability was identified in a previous audit, and patches were initially deployed to mitigate the risk. However, due to reported application instability and compatibility issues, the application team rolled back the patches, leaving the systems exposed. Despite the known risk, the vulnerability remains unaddressed, and no alternative mitigations have been put in place. Given the state of the web servers and their reliance on outdated, vulnerable software, how should the security team classify this risk in the context of web application security?

1. A. Vulnerable and Outdated Components — đáp án hiện tại
2. B. Software and Data Integrity Failures
3. C. Security Logging and Monitoring Failures
4. D. Insecure Design