A web application allows users to access a debug console that displays environment variables, including database credentials. The debug console is not restricted by IP address or authentication. What is the most severe impact of this misconfiguration?

An attacker can change the application's configuration.

An attacker can view sensitive environment variables and use the credentials to access the database.

An attacker can cause the server to crash by sending malformed requests.

An attacker can modify the application's source code.

A security auditor needs to quickly identify misconfigured HTTP headers, outdated server software, and enabled directory listing across a set of web servers. Which approach is most efficient for this task?

Run an automated vulnerability scanner that checks headers, version banners, and directory listing.

Manually browse each server and inspect the source code of every page.

Use a network packet analyzer to capture all traffic to the servers.

Review the server configuration files without testing the live servers.

A company is hardening its web server. They want to reduce the risk of information disclosure through error messages and server headers. Which set of actions is most effective?

Disable directory listing, remove server version headers, and configure custom error pages.

Change the server header to a fake version and leave error messages verbose.

Enable directory listing and add verbose error messages for debugging.

Disable all logging and monitoring to reduce the attack surface.

How can an attacker exploit default credentials on a web application's admin panel?

By intercepting and modifying network traffic

By uploading a malicious file to the server

By sending a specially crafted HTTP request to the server

By logging in with well-known default usernames and passwords

EC-CouncilWeb Application Hacking and Security

Domain 6Objective 1

Security Misconfigurations WAHS Practice Questions (Page 2)

Part of the Security Misconfiguration domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~19–31 in this domain), expect 6–10 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

5concepts

Questions 6–10

6application · medium
A web application allows users to access a debug console that displays environment variables, including database credentials. The debug console is not restricted by IP address or authentication. What is the most severe impact of this misconfiguration?
Select an answer first
7application · medium
A security auditor needs to quickly identify misconfigured HTTP headers, outdated server software, and enabled directory listing across a set of web servers. Which approach is most efficient for this task?
Select an answer first
8application · medium
A company is hardening its web server. They want to reduce the risk of information disclosure through error messages and server headers. Which set of actions is most effective?
Select an answer first
9foundation · easy
How can an attacker exploit default credentials on a web application's admin panel?
Select an answer first
10foundation · easy
Which of the following tools is commonly used to automatically scan web applications for security misconfigurations?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.