Which statement differentiates a vulnerability from a misconfiguration?

Which statement differentiates a vulnerability from a misconfiguration?

• A. A misconfiguration is a flaw in code or design.
• B. A vulnerability is an incorrect setup.
• C. A vulnerability is a flaw in code or design; a misconfiguration is an incorrect setup.
• D. Both are the same.

Answer: (C)

A vulnerability is a flaw in the code or design of a system that an attacker can exploit, while a misconfiguration is an incorrect or insecure setup of a component or service due to wrong settings or default values left in place. The statement that best differentiates them says exactly that: a vulnerability is a flaw in code or design, and a misconfiguration is an incorrect setup. This captures the idea that weaknesses can lie in how software is built, whereas misconfigurations come from how the system is configured. For clarity with examples: a buffer overflow due to improper bounds handling is a vulnerability in the software itself, whereas leaving a server with default admin credentials is a misconfiguration in how the system was set up. The other options blur these distinctions or claim they are the same, which isn’t accurate.

A vulnerability is a flaw in the code or design of a system that an attacker can exploit, while a misconfiguration is an incorrect or insecure setup of a component or service due to wrong settings or default values left in place. The statement that best differentiates them says exactly that: a vulnerability is a flaw in code or design, and a misconfiguration is an incorrect setup. This captures the idea that weaknesses can lie in how software is built, whereas misconfigurations come from how the system is configured.

For clarity with examples: a buffer overflow due to improper bounds handling is a vulnerability in the software itself, whereas leaving a server with default admin credentials is a misconfiguration in how the system was set up. The other options blur these distinctions or claim they are the same, which isn’t accurate.