Directory Browsing and Bruteforcing WAHS Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   During a web application assessment, a tester discovers that the /backup/ directory on an IIS server returns a full directory listing. The listing shows files named db_backup_2023.zip, db_backup_2024.zip, and a file called credentials.txt. What is the most immediate security concern with this finding?

   • AThe directory listing allows an attacker to upload malicious files to the server
   • BThe directory listing causes a denial of service by consuming excessive server resources
   • CThe directory listing indicates the server is running an outdated version of IIS
   • DThe directory listing exposes file names that reveal backup patterns and potentially sensitive files
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security auditor is reviewing a web server and notices that requesting /assets/ returns a page listing all JavaScript and CSS files. The auditor also notices that requesting /assets/js/ returns a listing of all JavaScript files. The organization wants to keep serving these static files but prevent enumeration. Which action should the auditor recommend?

   • ARename all files to remove the .js and .css extensions
   • BDisable directory listing at the web server level for all directories
   • CAdd a meta robots noindex tag to all HTML pages
   • DMove all static files to a different domain
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A security architect is designing a defense against brute-force attacks on a web application's login endpoint. The application is used by employees from various IP addresses, including shared office IPs. The architect wants to implement a control that minimizes the risk of locking out legitimate users while still being effective against distributed brute-force attacks. Which control is most appropriate?

   • AImplement a risk-based authentication that requires additional verification (e.g., CAPTCHA or MFA) when login attempts exceed a threshold from a given IP or device.
   • BImplement a strict account lockout policy after 3 failed attempts.
   • CDisable the login form and use client certificates.
   • DUse IP-based rate limiting with a low threshold.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A web application has a login form that is vulnerable to brute force attacks. The security team wants to implement a defense that slows down automated attacks while minimizing impact on legitimate users. Which combination of controls is most effective?

   • ARate limiting per IP and account lockout after a threshold of failed attempts
   • BCAPTCHA on every login attempt and a longer password policy
   • CLogging all failed attempts and displaying them to the user
   • DIP allowlisting and disabling the login form after business hours
   Reveal Solution Discussion Select an answer first
6. 40expert · medium

   A security consultant is assessing a web application hosted on a shared hosting environment. The consultant discovers that the /logs/ directory is browsable and contains application log files with sensitive information. The hosting provider does not allow changes to the main Apache configuration, but .htaccess files are permitted. The consultant must recommend a mitigation that works within these constraints. Which action is most appropriate?

   • AMove the log files outside the web root.
   • BRequest the hosting provider to disable directory listing globally.
   • CSet the log files to read-only permissions.
   • DCreate a .htaccess file in the /logs/ directory with 'Options -Indexes'.
   Reveal Solution Discussion Select an answer first