A team lead wants developer training to focus on the most common categories of web application security risk. Which resource is specifically designed to catalogue those widespread risks for awareness and training?
- AThe OWASP Top 10, a consensus list of the most critical web application security risks. Correct
- BThe shared responsibility model, which allocates security duties between the cloud provider and the customer.
- CA service level agreement, which defines the availability and performance commitments of a cloud service.
- DA recovery time objective, which sets the maximum tolerable duration to restore a service after disruption.
Why A is correct: Correct. The OWASP Top 10 is a widely used awareness document that ranks the most common and impactful web application security risks.
Why B is wrong: Tempting because it is central to cloud security, but it divides operational responsibility rather than cataloguing common application vulnerabilities.
Why C is wrong: Tempting because it governs the provider relationship, but an SLA sets service commitments and does not list web application risks.
Why D is wrong: Tempting because it is a familiar security metric, but an RTO is a continuity target and has nothing to do with cataloguing application risks.