Web Server Attacks EHE Practice Questions (Page 9)

Questions 41–44

1. 41application · medium

   A security assessment of a legacy web application reveals that the server responds to both GET and PUT requests on the same resource. An attacker could upload a malicious file by sending a PUT request to a known writable path. Which countermeasure should be implemented to directly address this issue?

   • AApply the latest security patches to the operating system
   • BImplement a Web Application Firewall (WAF) rule to block requests with a Content-Type of text/html
   • CDisable unnecessary HTTP methods on the web server
   • DMove the application to a different port
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A web server is experiencing a distributed denial-of-service (DDoS) attack that is saturating the network link. The server is also vulnerable to a known application-layer attack that can crash the worker process. The administrator needs to keep the server available for legitimate users. Which combination of countermeasures is most effective?

   • ABlock all incoming traffic from the internet
   • BRestart the server periodically to clear the crash state
   • CUse a DDoS mitigation service and apply the vendor patch for the application-layer vulnerability
   • DIncrease server bandwidth and disable unused services
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the primary security risk associated with leaving default credentials on a web server's administrative interface?

   • AThe server will log all user actions to a public file
   • BThe server may be slower because of extra authentication checks
   • CThe server will automatically block all external connections
   • DAn attacker can easily gain administrative access using well-known usernames and passwords
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A web server has been infected with malware that is using the server to launch attacks against other systems. The administrator has identified the malware but cannot remove it immediately because the server hosts a critical application. Which action should the administrator take first to limit the impact?

   • ADisconnect the server from the network to stop the outbound attacks
   • BApply the latest security patches
   • CEnable additional logging to capture the malware's activity
   • DChange the server's IP address
   Reveal Solution Discussion Select an answer first