An attacker discovers that a web application has a 'test' account with a weak password that is enabled in production. The attacker logs in and finds a page that displays database connection strings. What is the most likely impact of this misconfiguration?

The attacker can modify the application's source code.

The attacker gains access to sensitive database credentials and can connect to the database.

The attacker can perform a denial-of-service attack on the web server.

The attacker can change the application's configuration.

A company wants to reduce the risk of security misconfigurations in their web applications. They decide to implement a secure configuration baseline and conduct regular audits. Which additional practice is most important to ensure the baseline remains effective?

Keep the baseline unchanged to ensure stability

Share the baseline only with senior management

Update the baseline whenever new vulnerabilities or best practices are published

Only audit the baseline once a year

An application uses default credentials for its database administrator account. Which of the following is the most likely impact of this misconfiguration?

Enhanced logging of user activities

Unauthorized access to sensitive data

Increased application performance

EC-CouncilWeb Application Hacking and Security

Domain 6Objective 1

Security Misconfigurations WAHS Practice Questions (Page 1)

Part of the Security Misconfiguration domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~19–31 in this domain), expect 6–10 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

5concepts

Questions 1–5

1application · medium
An attacker discovers that a web application has a 'test' account with a weak password that is enabled in production. The attacker logs in and finds a page that displays database connection strings. What is the most likely impact of this misconfiguration?
Select an answer first
2foundation · easy
A web application is found to have an administrative console that is accessible without any authentication. Which type of security misconfiguration does this represent?
Select an answer first
3application · medium
A company wants to reduce the risk of security misconfigurations in their web applications. They decide to implement a secure configuration baseline and conduct regular audits. Which additional practice is most important to ensure the baseline remains effective?
Select an answer first
4application · medium
A tester is examining a web application and notices that the server responds with a '500 Internal Server Error' page that includes the full stack trace, including file paths and library versions. The tester uses this information to find a known vulnerability in an outdated library. Which misconfiguration is being exploited?
Select an answer first
5foundation · easy
An application uses default credentials for its database administrator account. Which of the following is the most likely impact of this misconfiguration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.

Security Misconfigurations WAHS Practice Questions (Page 1)

Questions 1–5

An attacker discovers that a web application has a 'test' account with a weak password that is enabled in production. The attacker logs in and finds a page that displays database connection strings. What is the most likely impact of this misconfiguration?

A web application is found to have an administrative console that is accessible without any authentication. Which type of security misconfiguration does this represent?

A company wants to reduce the risk of security misconfigurations in their web applications. They decide to implement a secure configuration baseline and conduct regular audits. Which additional practice is most important to ensure the baseline remains effective?

An application uses default credentials for its database administrator account. Which of the following is the most likely impact of this misconfiguration?

Keep studying — Security Misconfiguration