What is the best practice to manage risks from outdated components?

Use as many libraries as possible to increase functionality

Disable all third-party components

Regularly update and patch all third-party libraries and frameworks

What is a characteristic of a session fixation attack?

The attacker intercepts the session cookie after login

The attacker guesses the victim's password

The attacker forces the victim to use a known session ID

The attacker injects malicious code into the session

A security assessment of a web application reveals that the server returns detailed stack traces to users when an error occurs, and the default administrator account has not been disabled. Which of the following OWASP Top 10 categories best describes these findings?

Insufficient Logging and Monitoring

Which scenario is an example of sensitive data exposure?

Using HTTPS for all communications

Storing passwords in plaintext in a database

Implementing multi-factor authentication

A web application allows users to view their own invoices by navigating to a URL like /invoice?id=12345. A tester changes the id parameter to 12346 and successfully views another user's invoice. Which of the following vulnerabilities is being exploited?

Insecure Direct Object Reference (IDOR)

EC-CouncilCertified Ethical Hacker

Domain 5Objective 2

Web Application Attacks and OWASP Top 10 CEH Practice Questions (Page 10)

Part of the Web Application Hacking domain, which makes up ~8% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~8–13 in this domain), expect 2–3 from this objective — we provide 61 practice questions to prepare you well beyond it. (estimate)

61questions here

13free pages

14concepts

14 Concepts in This Objective

Web Application Attack Surface
OWASP Top 10 Overview
Injection Attacks
Broken Authentication and Session Management
Sensitive Data Exposure
XML External Entity (XXE) Attacks
Broken Access Control
Security Misconfiguration
Cross-Site Scripting (XSS)
Insecure Deserialization
Using Components with Known Vulnerabilities
Insufficient Logging and Monitoring
Web Application Attack Methodologies
Web Application Defense Mechanisms

Questions 46–50

46foundation · easy
What is the best practice to manage risks from outdated components?
Select an answer first
47foundation · easy
What is a characteristic of a session fixation attack?
Select an answer first
48application · medium
A security assessment of a web application reveals that the server returns detailed stack traces to users when an error occurs, and the default administrator account has not been disabled. Which of the following OWASP Top 10 categories best describes these findings?
Select an answer first
49foundation · easy
Which scenario is an example of sensitive data exposure?
Select an answer first
50application · medium
A web application allows users to view their own invoices by navigating to a URL like /invoice?id=12345. A tester changes the id parameter to 12346 and successfully views another user's invoice. Which of the following vulnerabilities is being exploited?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.