Which statement best describes an insecure protocol/service/port?

• A. A protocol, service, or port that transmits data or credentials in clear-text over the Internet, or that is easily exploitable if misconfigured.
• B. A protocol, service, or port that lacks controls over confidentiality and/or integrity.
• C. A protocol that always uses encryption and strong authentication by default.
• D. A protocol that supports secure channels only.

Answer: (B)

An insecure protocol/service/port is one that does not provide enough protection for data in transit, specifically lacking safeguards for confidentiality and/or data integrity. If data can be read by someone else or altered while it’s being transmitted, those protections aren’t in place. Lacking these controls is the core issue, which is why describing it as not having confidentiality and/or integrity protections best captures the risk.

The other statements describe scenarios that are either secure (always using encryption and strong authentication by default, or only supporting secure channels) or focus on a symptom like clear-text transmission. While clear-text transmission is a common insecure trait, the essential idea is the absence of proper confidentiality and integrity protections.