Web Server Attacks EHE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A small e-commerce company recently migrated its web storefront to a new Linux server. The administrator left the default installation of Apache with the default 'it works' page, enabled directory listing, and did not change the default 'admin' account on the content management system. Which two countermeasures should the administrator implement first to reduce the most immediate risk?

   • ADisable directory listing and change default credentials
   • BMove the server behind a VPN and restrict IP access
   • CApply the latest OS patches and disable unused modules
   • DInstall a web application firewall and enable HTTPS
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An attacker is attempting to access files outside the web root by sending requests like /../../etc/passwd. The web server is running on a Linux system. Which countermeasure would be most effective in blocking this type of attack?

   • AUse a firewall to block all incoming traffic from the attacker's IP
   • BNormalize and validate all file paths in the application code
   • CRename the /etc directory to a less predictable name
   • DDisable the web server's error messages
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A web server is experiencing a DoS attack that is overwhelming the network bandwidth. The attack traffic is coming from many distributed sources. The server is behind a firewall and a load balancer. Which mitigation strategy is most effective in this scenario?

   • ABlock the attacking IP addresses at the firewall
   • BDisable the web server's logging to reduce resource usage
   • CIncrease the server's bandwidth
   • DUse a cloud-based DDoS protection service that can absorb and filter attack traffic
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst is reviewing web server logs and notices requests like 'GET /../../etc/passwd' and 'GET /%2e%2e/%2e%2e/etc/passwd'. The server is returning HTTP 200 responses with file content. Which web server attack technique is being attempted, and what is the most effective countermeasure?

   • ACross-site scripting; sanitize user input
   • BHTTP verb tampering; restrict allowed HTTP methods
   • CDenial of service; rate-limit incoming requests
   • DDirectory traversal; implement input validation and normalize paths
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A web server is running a content management system (CMS) that is frequently targeted by attackers. The server also hosts other applications. The company wants to isolate the CMS to reduce the impact of a compromise. Which approach is most effective?

   • AUse a different CMS
   • BInstall a WAF in front of the CMS
   • CDisable all CMS plugins
   • DRun the CMS in a container or virtual machine with minimal privileges and network access
   Reveal Solution Discussion Select an answer first