What is the purpose of output encoding in web application defense?

To ensure that user input is treated as data, not executable code

To compress data for faster transmission

Which of the following is an effective prevention method against XSS attacks?

Output encoding of user-supplied data

Why can verbose error messages be a security risk?

They may reveal internal system details that help an attacker

They prevent users from using the application

What is the key difference between reflected and stored XSS?

Reflected XSS only affects the attacker, while stored XSS affects the victim

Reflected XSS is a server-side vulnerability, while stored XSS is client-side

Reflected XSS is more dangerous than stored XSS

Reflected XSS is delivered through a URL and not persisted, while stored XSS is saved on the server

What is the primary impact of an XML External Entity (XXE) vulnerability?

Performing cross-site scripting

Executing arbitrary SQL queries

Reading local files from the server

EC-CouncilCertified Ethical Hacker

Domain 5Objective 2

Web Application Attacks and OWASP Top 10 CEH Practice Questions (Page 9)

Part of the Web Application Hacking domain, which makes up ~8% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~8–13 in this domain), expect 2–3 from this objective — we provide 61 practice questions to prepare you well beyond it. (estimate)

61questions here

13free pages

14concepts

14 Concepts in This Objective

Web Application Attack Surface
OWASP Top 10 Overview
Injection Attacks
Broken Authentication and Session Management
Sensitive Data Exposure
XML External Entity (XXE) Attacks
Broken Access Control
Security Misconfiguration
Cross-Site Scripting (XSS)
Insecure Deserialization
Using Components with Known Vulnerabilities
Insufficient Logging and Monitoring
Web Application Attack Methodologies
Web Application Defense Mechanisms

Questions 41–45

41foundation · easy
What is the purpose of output encoding in web application defense?
Select an answer first
42foundation · easy
Which of the following is an effective prevention method against XSS attacks?
Select an answer first
43foundation · easy
Why can verbose error messages be a security risk?
Select an answer first
44foundation · easy
What is the key difference between reflected and stored XSS?
Select an answer first
45foundation · easy
What is the primary impact of an XML External Entity (XXE) vulnerability?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.