Directory Browsing and Bruteforcing WAHS Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   During a penetration test, an analyst discovers that the /backup directory on a web server has directory browsing enabled. What is the most direct way to leverage this misconfiguration to find sensitive information?

   • AUse the directory listing to identify and download files such as database backups or configuration files.
   • BExploit the directory listing to bypass authentication on other parts of the application.
   • CAttempt to upload a web shell to the /backup directory.
   • DPerform a SQL injection attack on the directory listing page.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team is implementing rate limiting on a public API to prevent brute-force attacks on the authentication endpoint. The API is consumed by both mobile apps and third-party integrations. The team wants to avoid breaking legitimate clients. Which rate-limiting strategy is most appropriate?

   • AImplement per-user rate limiting based on the authenticated user ID after login, with a generous limit for the authentication endpoint.
   • BDo not implement rate limiting because it is difficult to balance.
   • CImplement a global rate limit for all requests to the authentication endpoint.
   • DImplement per-IP rate limiting with a low threshold.
   Reveal Solution Discussion Select an answer first
4. 3application · hard

   A web application is experiencing a brute-force attack on its login endpoint. The security team wants to implement rate limiting. However, the application is behind a load balancer that does not preserve the client IP address in the HTTP headers. What is the most important consideration when implementing rate limiting?

   • AUse the 'X-Forwarded-For' header to identify the client IP, but only if the load balancer is configured to overwrite it.
   • BRate limit based on the session cookie.
   • CRate limit based on the source IP address of the connection to the load balancer.
   • DDisable rate limiting because it cannot be implemented behind a load balancer.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A web application's login endpoint is being targeted by a distributed brute force attack from many different IP addresses. The security team wants to implement a defense that is effective against distributed attacks while minimizing impact on legitimate users. Which control is most appropriate?

   • AImplement account lockout after a threshold of failed attempts per account
   • BImplement rate limiting per IP address
   • CBlock all traffic from non-geographic regions
   • DIncrease the password complexity requirements
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security auditor is reviewing a web server configuration and finds that directory listing is enabled on the /assets/ directory. The directory contains static files such as images and CSS, but also a subdirectory /assets/private/ that should not be accessible. The auditor wants to disable directory listing for the entire /assets/ directory, but the application requires that some subdirectories (e.g., /assets/images/) allow direct file access. Which configuration is most appropriate?

   • ASet permissions on /assets/private/ to 000.
   • BDisable directory listing globally in the server configuration, then re-enable it only for specific subdirectories that need it.
   • CDisable directory listing only for the /assets/private/ directory.
   • DMove the /assets/private/ directory outside the web root.
   Reveal Solution Discussion Select an answer first