EC-CouncilCertified Ethical Hacker
Domain 5Objective 2
Web Application Attacks and OWASP Top 10 CEH Practice Questions (Page 1)
Part of the Web Application Hacking domain, which makes up ~8% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~8–13 in this domain), expect 2–3 from this objective — we provide 61 practice questions to prepare you well beyond it. (estimate)
61questions here
13free pages
14concepts
Questions 1–5
- 1
During the mapping phase of web application testing, what is the primary goal?
Select an answer first - 2
A penetration tester is mapping the attack surface of a web application that uses a REST API backend and a MySQL database. During reconnaissance, the tester identifies that the API endpoint /api/user/profile?id=123 returns the profile of user 123 without any ownership check. Which two components of the attack surface are directly implicated in this vulnerability?
Select an answer first - 3
What is an Insecure Direct Object Reference (IDOR) vulnerability?
Select an answer first - 4
A security tester discovers that a search page reflects the user's query in the response without encoding it. The tester crafts a URL with a script payload and sends it to a victim, who clicks the link and executes the script. Which type of XSS is this?
Select an answer first - 5
Which of the following is a common mitigation against SQL injection attacks?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.