What is a potential impact of an arbitrary file download vulnerability?

Cross-site scripting on the client.

Denial of service by exhausting server resources.

Remote code execution on the server.

Exposure of sensitive data such as configuration files and source code.

What is the most severe potential impact of an arbitrary file upload vulnerability?

Remote code execution on the server

Session hijacking of other users

Denial of service by filling the disk

Cross-site scripting (XSS) on the client side

What is the primary goal of a path traversal attack in a file download feature?

To cause a denial of service by requesting large files.

To modify the content of files on the server.

To retrieve files that are not intended to be publicly accessible.

To upload a web shell to the server.

A penetration tester is testing a web application that allows users to download reports. The URL is /download.php?file=report.pdf. The tester tries /download.php?file=../../../../var/www/html/config.php and receives the contents of the configuration file. Which of the following is the MOST likely impact of this vulnerability?

Cross-site scripting (XSS) attacks.

Exposure of sensitive information such as database credentials and API keys.

Remote code execution on the server.

Denial of service by downloading large files.

Which of the following is a server-side validation technique to prevent arbitrary file uploads?

Relying on the browser to block dangerous files

Checking the file extension against a whitelist of allowed types

Checking the MIME type from the client request

Using JavaScript to check the file type before submission

EC-CouncilWeb Application Hacking and Security

Domain 7Objective 3

Arbitrary File Upload and Download WAHS Practice Questions (Page 1)

Part of the File Inclusion and Upload Attacks domain, which makes up ~7% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~10–17 in this domain), expect 3–6 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

10concepts

Questions 1–5

1foundation · easy
What is a potential impact of an arbitrary file download vulnerability?
Select an answer first
2foundation · easy
What is the most severe potential impact of an arbitrary file upload vulnerability?
Select an answer first
3foundation · easy
What is the primary goal of a path traversal attack in a file download feature?
Select an answer first
4application · medium
A penetration tester is testing a web application that allows users to download reports. The URL is /download.php?file=report.pdf. The tester tries /download.php?file=../../../../var/www/html/config.php and receives the contents of the configuration file. Which of the following is the MOST likely impact of this vulnerability?
Select an answer first
5foundation · easy
Which of the following is a server-side validation technique to prevent arbitrary file uploads?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.