A developer is configuring an Apache web server for a new application. The application needs to serve user-uploaded images from the /media/ directory. The developer wants to ensure that users cannot see a listing of all uploaded files but can still access individual files by their exact URL. Which configuration should the developer apply?

Add Require all denied to the /media/ directory configuration

Set AllowOverride None in the /media/ directory configuration

Add Options -Indexes to the /media/ directory configuration

Set DirectoryIndex index.html in the /media/ directory configuration

A system administrator is configuring a new Nginx web server. The administrator wants to ensure that directory listings are disabled by default for all locations. Which configuration directive should be used?

Set 'index index.html;' in the server block.

Set 'autoindex off;' in the server or location block.

Set 'disable_directory_listing on;' in the http block.

Set 'deny all;' in the location block.

A penetration tester is assessing a web application and discovers that the /admin/ directory returns a 403 Forbidden error. However, when the tester requests /admin/backup/, the server responds with a directory listing that includes files such as 'users.sql' and 'config.php.bak'. The tester wants to identify additional hidden directories that may not be linked from the application. Which approach is most effective for this purpose?

Attempt to access /admin/index.php directly to see if the directory listing is bypassed.

Check the HTTP response headers for the 'Server' header to identify the web server software.

Manually browse to common paths like /admin/backup/ and /admin/temp/.

Use a directory brute-forcing tool like gobuster with a wordlist against the /admin/ base path.

A system administrator is hardening an IIS web server. The server hosts multiple applications, and some directories should not be browsable. The administrator wants to disable directory browsing for the entire server while ensuring that applications can still serve their default documents. Which configuration change should be made?

Set Directory Browsing to Disabled in the IIS feature delegation or site-level settings

Set the physical path permissions to Read for the IUSR account

Remove the default document from each application's configuration

Add a web.config file with to each application

Why is directory browsing considered a security risk for a web application?

It allows attackers to upload malicious files to the server.

It causes the server to consume excessive resources, leading to denial of service.

It reveals the internal directory structure and potentially sensitive files to anyone who requests the directory.

It enables attackers to execute arbitrary commands on the server.

EC-CouncilWeb Application Hacking and Security

Domain 6Objective 2

Directory Browsing and Bruteforcing WAHS Practice Questions (Page 2)

Part of the Security Misconfiguration domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~19–31 in this domain), expect 6–10 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

Questions 6–10

6application · medium
A developer is configuring an Apache web server for a new application. The application needs to serve user-uploaded images from the /media/ directory. The developer wants to ensure that users cannot see a listing of all uploaded files but can still access individual files by their exact URL. Which configuration should the developer apply?
Select an answer first
7application · easy
A system administrator is configuring a new Nginx web server. The administrator wants to ensure that directory listings are disabled by default for all locations. Which configuration directive should be used?
Select an answer first
8application · medium
A penetration tester is assessing a web application and discovers that the /admin/ directory returns a 403 Forbidden error. However, when the tester requests /admin/backup/, the server responds with a directory listing that includes files such as 'users.sql' and 'config.php.bak'. The tester wants to identify additional hidden directories that may not be linked from the application. Which approach is most effective for this purpose?
Select an answer first
9application · medium
A system administrator is hardening an IIS web server. The server hosts multiple applications, and some directories should not be browsable. The administrator wants to disable directory browsing for the entire server while ensuring that applications can still serve their default documents. Which configuration change should be made?
Select an answer first
10foundation · easy
Why is directory browsing considered a security risk for a web application?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.

Directory Browsing and Bruteforcing WAHS Practice Questions (Page 2)

Questions 6–10

A system administrator is configuring a new Nginx web server. The administrator wants to ensure that directory listings are disabled by default for all locations. Which configuration directive should be used?

Why is directory browsing considered a security risk for a web application?

Keep studying — Security Misconfiguration