Hacking Web Servers CEH Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the context of web server architecture, which component is responsible for interpreting the HTTP request and generating the appropriate HTTP response?

   • AThe web server software
   • BThe DNS resolver
   • CThe network firewall
   • DThe operating system kernel
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team is conducting a vulnerability assessment of a web server that hosts a critical application. The team wants to identify misconfigurations, outdated software, and potential directory traversal issues without causing service disruption. Which approach best meets these requirements?

   • AUse a penetration testing framework to launch real exploits
   • BRun a full active vulnerability scan with exploitation attempts
   • CPerform a passive scan and use a web crawler to map the application
   • DDisable the web server and run an offline vulnerability scanner
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company runs a web server that has been compromised in the past. The administrator wants to implement a comprehensive security monitoring solution but has a limited budget. The server hosts a public website and an internal admin panel. Which monitoring strategy provides the best balance of cost and effectiveness?

   • ADeploy a commercial SIEM solution with real-time alerting
   • BInstall a host-based intrusion detection system (HIDS) on the server only
   • CRely on the hosting provider's basic access logs
   • DEnable detailed logging on the web server and use a free log analysis tool to review anomalies
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   During a penetration test, you have identified a web server vulnerable to a known remote code execution (RCE) vulnerability. The client requires you to demonstrate the impact without causing service disruption. Which approach best meets this requirement?

   • AUse the exploit module to gain a shell and then immediately terminate the session.
   • BRun Metasploit's exploit module with the 'check' command to confirm the vulnerability without launching the exploit.
   • CCraft a manual HTTP request that triggers the vulnerability but only executes a benign command like 'id'.
   • DRun a vulnerability scanner like Nikto to confirm the vulnerability.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which attack involves an attacker repeatedly trying different username and password combinations against a web server's login page?

   • ABrute force attack
   • BHTTP response splitting
   • CDistributed denial of service (DDoS)
   • DDirectory traversal
   Reveal Solution Discussion Select an answer first