Hacking Web Servers CEH Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   When a web browser sends a GET request for a static HTML page, which sequence best describes the typical flow on the server?

   • AThe web server reads the file from disk and returns it in the HTTP response body.
   • BThe web server compresses the request and sends it to a load balancer for processing.
   • CThe web server executes a server-side script and returns the script's source code.
   • DThe web server forwards the request to a database and returns the query result.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A web administrator is troubleshooting slow response times on an IIS server. The server logs show a high number of HTTP 500 errors and a spike in requests to a dynamic page that executes complex database queries. The administrator suspects a denial-of-service condition caused by resource exhaustion. Which component of the web server architecture is most likely being overwhelmed?

   • AThe HTTP.sys kernel driver
   • BThe network interface card
   • CThe application pool's worker process
   • DThe DNS resolver
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which tool is commonly used to scan web servers for known vulnerabilities and misconfigurations, and is often used in the reconnaissance phase of an attack?

   • AMetasploit
   • BNikto
   • CHydra
   • DNessus
   Reveal Solution Discussion Select an answer first
5. 39application · easy

   You are performing a vulnerability assessment of a web server. You need to identify which HTTP methods are enabled and whether the server allows TRACE, which could enable cross-site tracing attacks. Which tool or technique is most appropriate?

   • ARun Nikto with the -method TRACE option.
   • BUse Nmap's http-methods script.
   • CSend an HTTP OPTIONS request to the server and inspect the Allow header.
   • DReview the server's configuration files manually.
   Reveal Solution Discussion Select an answer first
6. 40application · easy

   During a penetration test, you have identified that a web server is running an outdated version of Apache with a known remote code execution vulnerability. You need to gain a shell on the server to demonstrate impact. Which tool is most appropriate for this step?

   • AMetasploit with the appropriate exploit module
   • BNmap to enumerate open ports
   • CBurp Suite's Repeater to manually craft HTTP requests
   • DNikto to scan for more vulnerabilities
   Reveal Solution Discussion Select an answer first