Directory Browsing and Bruteforcing WAHS Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company's web application has been suffering from brute-force attacks on its admin login page. The attackers use distributed IP addresses, so simple IP-based rate limiting is not effective. The security team wants to implement a countermeasure that can mitigate the attack without locking out legitimate administrators who occasionally mistype their password. Which approach is most effective?

   • AImplement a progressive delay that increases after each failed attempt, resetting after a successful login.
   • BDisable the admin login page and use a VPN for admin access.
   • CBlock all traffic from countries where the attacks originate.
   • DRequire a CAPTCHA on every login attempt.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During a security assessment, a tester discovers that the /private/ directory on a web server returns a directory listing. The listing shows files named user_database.sql, config.php.bak, and admin_notes.txt. What is the most significant risk associated with this finding?

   • AThe files may contain sensitive data such as database credentials, source code, or internal notes
   • BThe directory listing allows an attacker to upload malicious files
   • CThe directory listing reveals the server's operating system version
   • DThe directory listing causes the server to crash
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which Apache server configuration directive is used to disable directory browsing (autoindex) for a specific directory?

   • AAllowOverride None
   • BOptions -Indexes
   • CRequire all denied
   • DDirectoryIndex disabled
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company runs an IIS web server hosting a public-facing application. A security scan reveals that several directories under the content root return directory listings, exposing internal file names. The security team must disable directory browsing across the entire site without affecting the application's functionality. What is the most reliable method to achieve this?

   • AAdd a 'web.config' file to each affected directory with the 'directoryBrowse' element set to 'false'.
   • BSet the 'Directory Browsing' feature to Disabled in the IIS Management Console for the entire site.
   • CRemove the 'IUSR' account from the 'Read' permission on all directories.
   • DEnable 'Request Filtering' to deny URL requests that end with a forward slash.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is an effective countermeasure against brute force attacks on a login form?

   • ADisabling HTTPS to reduce latency.
   • BAllowing unlimited login attempts to avoid user frustration.
   • CUsing a longer session timeout.
   • DImplementing account lockout after a certain number of failed attempts.
   Reveal Solution Discussion Select an answer first