The correct answer is Social engineering.

Social engineering is correct because the Top Ten lists published for web applications focus on technical vulnerabilities in software and configuration rather than human focused attack techniques. Social engineering targets people and processes and is not a specific web application vulnerability so it does not appear on the Top Ten list.

Examples of items that do appear on the Top Ten include Cross site scripting, Insecure deserialization, and XML external entities, and that is why those options are not the right choice for this question.

Insecure deserialization is a recognized application risk and has been included on Top Ten lists because unsafe deserialization of untrusted data can lead to remote code execution and severe compromise.

Cross site scripting is a classic web application vulnerability that allows attackers to inject client side scripts and it is consistently represented in web application Top Ten lists.

XML external entities refers to XXE vulnerabilities where XML external entity processing can cause data exfiltration or denial of service and it is included when XML parsing risks are considered.

Full AWS Practitioner Certification Question