A review produces two findings. First, a web server's settings still allow a deprecated TLS version even though the software fully supports current versions. Second, a parsing library has a buffer overflow that only a vendor code update can fix. How should the first finding be classified?
Select an answer to reveal the explanation.
Short Explanation
Think of it like a car with a great alarm that you just never switched on -- the car's fine, the setting's wrong. A server allowing an old TLS version when it supports the new ones is a configuration problem, and you fix it with a settings change. Don't lump it in with code bugs that need the vendor to ship a patch.
Full Explanation
Vulnerability types differ in cause and remedy. A misconfiguration is a weakness created by how a system is set up, such as enabled legacy protocols, default credentials or overly broad permissions, while the underlying software works as designed. The deprecated TLS setting fits that pattern because the server already supports current versions and the administrator can remove the old one by changing configuration. A zero-day is a flaw exploited before the vendor has released a fix, which is a statement about disclosure and patch timing, not about whether a patch is needed; a configuration weakness is not a zero-day. Calling it a software flaw blurs the distinction the classification exists to make: a code defect requires a vendor update, as with the buffer overflow in the second finding, while this issue does not. A supply chain vulnerability arises when a supplier, component or update channel introduces risk; a protocol defined by a standards body and then left enabled locally is a local configuration choice. Exam caveat: some findings have both causes, so classify by what actually fixes the problem. Operational check: update the hardened configuration baseline to disable the deprecated version, apply it, and rescan to confirm only current versions are negotiated.