Remote File Inclusion (RFI) WAHS Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is the most effective remediation to prevent Remote File Inclusion vulnerabilities?

   • ASanitize user input by removing all slashes and dots.
   • BUse a web application firewall (WAF) to block requests containing 'http://'.
   • CDisable allow_url_fopen and allow_url_include in the PHP configuration.
   • DUse a custom error handler to hide error messages.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is reviewing a PHP application's source code and wants to identify parameters that could be vulnerable to RFI. Which code pattern is most indicative of an RFI vulnerability?

   • A`include($_GET['module']);`
   • B`file_get_contents($_GET['file']);`
   • C`require_once('config.php');`
   • D`move_uploaded_file($_FILES['file']['tmp_name'], $target);`
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A developer is tasked with preventing RFI in a PHP application. The application uses include($_GET['file']);. The developer proposes disabling allow_url_include. What is the main limitation of this approach?

   • AIt can be overridden by the application using ini_set().
   • BIt does not prevent LFI, which can also lead to code execution or data disclosure.
   • CIt does not work on all web servers.
   • DIt requires a server restart, which causes downtime.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which statement best describes a Remote File Inclusion (RFI) vulnerability?

   • AAn attacker exploits a misconfigured server to list directory contents and then reads sensitive files directly from the web root.
   • BAn attacker causes the application to fetch and execute a file from an external server by manipulating a parameter that is passed to a file inclusion function.
   • CAn attacker injects SQL code into a database query to retrieve data from a remote database server.
   • DAn attacker uploads a malicious file to the server and then triggers its execution by accessing it through a predictable path.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company's web application was compromised via an RFI attack. The incident response team needs to prevent recurrence. Which combination of measures is most effective?

   • ADisable `allow_url_fopen` only.
   • BOnly use a Web Application Firewall (WAF) to block requests containing `http://`.
   • CDisable `allow_url_include`, use an allowlist for file parameters, and keep the application patched.
   • DMove the application to a different server.
   Reveal Solution Discussion Select an answer first