Security Misconfigurations WAHS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a best practice to mitigate security misconfigurations in web applications?

   • AEnable verbose error messages for debugging in production
   • BUse default credentials for all administrative accounts
   • CDisable unnecessary features and services
   • DAllow directory listing to make files easier to find
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A web application exposes detailed stack traces to users when an error occurs. What is the most direct impact of this misconfiguration on the application's security?

   • ALoss of non-repudiation for user actions
   • BLoss of confidentiality of internal system details
   • CLoss of availability of the application
   • DLoss of integrity of application data
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team is tasked with detecting misconfigurations in their web application's database, such as default accounts, weak passwords, and excessive privileges. Which tool or technique is best suited for this task?

   • ADatabase vulnerability scanner
   • BWeb application firewall
   • CNetwork packet analyzer
   • DManual review of application code
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company runs a legacy web application that requires a specific older version of a library to function correctly. The library has known vulnerabilities, but upgrading breaks the application. The security team must reduce the risk while maintaining functionality. Which approach best balances security and operational constraints?

   • AApply virtual patching through a web application firewall (WAF) to mitigate known vulnerabilities.
   • BUpgrade the library immediately, even though it breaks the application.
   • CDisable the library and remove the feature that uses it.
   • DIgnore the vulnerability because the application is internal.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A penetration tester is assessing a web application and finds that the application is running in debug mode, which displays detailed error messages. The tester also notices that the application uses a framework with a known remote code execution vulnerability. The tester wants to exploit this vulnerability but needs to know the exact framework version. How can the tester obtain this information?

   • ATrigger an error that reveals the framework version in the debug output
   • BUse a network scanner to enumerate open ports
   • CCheck the HTTP response headers for the framework version
   • DAttempt default credentials on the admin panel
   Reveal Solution Discussion Select an answer first