The scenario describes a web application thatunintentionally reveals sensitive member biodatato attackers. This is a classic case ofinformation leakage, where confidential or private data becomes exposed due to poor access control, improper output handling, verbose error messages, misconfigured endpoints, insecure direct object references, or unintended exposure through pages, APIs, backups, or logs. In forensic and web security documentation, information leakage is defined by theunauthorized disclosure of data, even if the attacker does not alter the system. The key indicator here is that the application is “revealing” biodata—meaning confidentiality is breached.

Bob’s response—using acontent filtering mechanism—also aligns with mitigating data exposure. Content filtering can prevent sensitive fields from being returned, mask personally identifiable information, restrict responses based on user role, and sanitize outputs before they leave the server.

The other options do not match the described impact.Buffer overflowis a low-level memory corruption vulnerability, typically associated with native code execution rather than accidental biodata exposure.Authentication hijackinginvolves taking over sessions/credentials, andcookie poisoninginvolves manipulating cookie values to gain privileges or alter behavior—neither is explicitly indicated. Therefore, the identified threat isInformation leakage (B).