Which of the following is not a type of access control vulnerability?

• A. Weak passwords
• B. Configuration flaws
• C. Strong encryption
• D. Inadequate user permissions

Answer: (C)

Strong encryption is not a type of access control vulnerability because it enhances security rather than detracts from it. Encryption serves as a crucial defense mechanism that protects data by making it unreadable to unauthorized users. When implemented effectively, strong encryption helps safeguard sensitive information from interception and unauthorized access, thereby strengthening access control measures.

On the other hand, weak passwords, configuration flaws, and inadequate user permissions can all create vulnerabilities in access control systems. Weak passwords can be easily compromised, allowing attackers to gain unauthorized access. Configuration flaws may result in misconfigurations that expose systems to security risks. Inadequate user permissions can lead to situations where users have access to resources beyond what is necessary for their roles, increasing the likelihood of accidental or deliberate misuse. In contrast, strong encryption serves to mitigate these types of vulnerabilities, making it a fundamental component of secure access control rather than a vulnerability itself.