Web Server Attacks EHE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A web server is found to be vulnerable to directory traversal. The application is written in PHP and uses user input to include files. The development team wants to fix the issue without rewriting the entire application. Which countermeasure is most appropriate?

   • AImplement a whitelist of allowed files and validate user input against it
   • BChange the web server's document root to a different directory
   • CUse a web application firewall to block requests containing '..'
   • DDisable PHP's file inclusion functions
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security analyst is investigating a web server that is responding slowly. The analyst notices a large number of requests for a single URL, each with a different 'User-Agent' string and from different source IPs. The requests are all for a resource that requires significant CPU processing. What type of attack is this, and what is the best immediate mitigation?

   • ACross-site scripting; sanitize input
   • BDirectory traversal; block requests with '..'
   • CHTTP verb tampering; restrict allowed methods
   • DDistributed denial of service (DDoS); implement rate limiting and request filtering
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security audit reveals that a web server is running with default credentials on the management console, has an outdated version of the web server software, and has several unnecessary modules enabled. The server is critical and cannot be taken offline for more than 30 minutes. Which remediation plan should be prioritized?

   • AApply all patches and disable all modules, even if it takes longer than 30 minutes
   • BChange default credentials, apply critical security patches, and disable unnecessary modules within the 30-minute window
   • COnly change the default credentials and schedule the rest for later
   • DReplace the server with a new one immediately
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A penetration tester is assessing a web server that only allows GET and POST requests. The tester sends a PUT request to upload a file, but the server responds with '405 Method Not Allowed'. The tester then sends an OPTIONS request and sees that TRACE is also listed. Which attack technique is the tester exploring, and what should the administrator do?

   • ADirectory traversal; implement path filtering
   • BDenial of service; increase server capacity
   • CHTTP verb tampering; disable TRACE and restrict methods to GET and POST
   • DSQL injection; use parameterized queries
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security consultant is reviewing the attack surface of a web server that hosts a public e-commerce site. The server runs Apache, PHP, and MySQL, and has an admin panel accessible from the internet. The consultant wants to reduce the attack surface without affecting the site's functionality. Which action should the consultant recommend?

   • ARestrict access to the admin panel to specific IP addresses
   • BRemove MySQL from the server
   • CBlock all incoming traffic on port 80
   • DDisable PHP on the server
   Reveal Solution Discussion Select an answer first