Web Server Attacks EHE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which web server attack technique involves manipulating file path parameters to access files outside the intended directory?

   • ADirectory traversal
   • BDenial of service (DoS)
   • CSQL injection
   • DHTTP verb tampering
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company's web server is running an outdated version of Apache that has a known remote code execution vulnerability. The server also has the WebDAV module enabled, which is not needed for the application. An administrator is planning to mitigate the risk. Which action should the administrator take first?

   • AImplement a web application firewall to block exploit attempts
   • BChange the default administrator password on the server
   • CDisable directory listing in the web server configuration
   • DUpgrade Apache to a patched version and disable WebDAV
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security team is investigating a web server breach. The logs show that an attacker used a valid session cookie to access the admin panel, but the attacker's IP address is different from the legitimate admin's IP. The server is configured to allow session cookies to be sent over HTTP, and the admin panel does not have additional authentication factors. What is the most likely attack vector, and what is the best countermeasure?

   • ADenial of service; rate-limit requests
   • BSession hijacking via cookie theft; enable Secure and HttpOnly flags on cookies and enforce HTTPS
   • CDirectory traversal; implement input validation
   • DHTTP verb tampering; restrict methods
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A web server is being hardened. The server is running a public-facing application and also hosts a database that is only accessed by the application. The database is currently listening on all interfaces. Which change should be made to reduce the attack surface?

   • ADisable the database's authentication
   • BBind the database service to the loopback interface or a private network interface
   • CChange the database's default port
   • DMove the database to a different server
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following best describes the attack surface of a typical web server?

   • AThe operating system, web server software, application code, and network services exposed to clients
   • BOnly the public IP address and the DNS records of the server
   • COnly the web application code and the database it uses
   • DThe physical hardware and the data center where the server is hosted
   Reveal Solution Discussion Select an answer first