What is the most effective way to protect sensitive data at rest?

Encrypting the data with strong algorithms

A security audit of a web application reveals that the server is running an outdated version of the web server software with known vulnerabilities. The application also has directory listing enabled, exposing sensitive files. Which of the following is the most comprehensive remediation?

Move the sensitive files to a different directory

Disable the directory listing only

Implement a Web Application Firewall (WAF) to block attacks

Update the web server software and disable directory listing

What is the primary goal of an LDAP injection attack?

To manipulate LDAP queries to bypass authentication or extract directory information

To cause a denial of service by flooding the network

To inject malicious scripts into web pages

To read arbitrary files from the server

Which of the following is an example of privilege escalation?

A standard user gains administrative rights by exploiting a vulnerability

An administrator changes their own password

A user logs in with their own credentials

A security analyst is reviewing the OWASP Top 10 to prioritize remediation efforts for a web application. The application stores user session tokens in cookies without the Secure or HttpOnly flags, and it does not log failed login attempts. Which two OWASP Top 10 risk categories are most directly represented by these findings?

Sensitive Data Exposure and Cryptographic Failures

Identification and Authentication Failures and Insufficient Logging and Monitoring

Cross-Site Scripting and Injection

Broken Access Control and Security Misconfiguration

EC-CouncilCertified Ethical Hacker

Domain 5Objective 2

Web Application Attacks and OWASP Top 10 CEH Practice Questions (Page 11)

Part of the Web Application Hacking domain, which makes up ~8% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~8–13 in this domain), expect 2–3 from this objective — we provide 61 practice questions to prepare you well beyond it. (estimate)

61questions here

13free pages

14concepts

14 Concepts in This Objective

Web Application Attack Surface
OWASP Top 10 Overview
Injection Attacks
Broken Authentication and Session Management
Sensitive Data Exposure
XML External Entity (XXE) Attacks
Broken Access Control
Security Misconfiguration
Cross-Site Scripting (XSS)
Insecure Deserialization
Using Components with Known Vulnerabilities
Insufficient Logging and Monitoring
Web Application Attack Methodologies
Web Application Defense Mechanisms

Questions 51–55

51foundation · easy
What is the most effective way to protect sensitive data at rest?
Select an answer first
52expert · hard
A security audit of a web application reveals that the server is running an outdated version of the web server software with known vulnerabilities. The application also has directory listing enabled, exposing sensitive files. Which of the following is the most comprehensive remediation?
Select an answer first
53foundation · easy
What is the primary goal of an LDAP injection attack?
Select an answer first
54foundation · easy
Which of the following is an example of privilege escalation?
Select an answer first
55application · medium
A security analyst is reviewing the OWASP Top 10 to prioritize remediation efforts for a web application. The application stores user session tokens in cookies without the Secure or HttpOnly flags, and it does not log failed login attempts. Which two OWASP Top 10 risk categories are most directly represented by these findings?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.