A security analyst is evaluating the impact of a misconfiguration where the web application's admin panel is accessible without authentication. Which of the following is the most likely impact?

An attacker can modify application settings and access sensitive data

The application will be protected by the firewall

The application will become slower due to increased traffic

The application will display verbose error messages

A security team wants to identify misconfigurations in their web server configuration, application framework settings, and database permissions. They need a method that can be repeated regularly and does not require manual review of every configuration file. Which approach best meets this requirement?

Ask developers to document their configuration choices

Perform a one-time penetration test and fix all findings

Manually review the web server logs for unusual requests

Run a vulnerability scanner that includes configuration checks against industry benchmarks

A security team is performing a misconfiguration assessment of a web application. Which of the following are effective techniques for detecting security misconfigurations? Select all that apply.

Checking the server's physical location.

Reviewing HTTP response headers for missing security headers.

Sending malformed requests to trigger verbose error messages.

Testing for default credentials on administrative interfaces.

A company's security policy requires that all web servers be configured according to a hardened baseline. The security team needs to ensure that any deviation from the baseline is detected and corrected quickly. Which approach is most effective?

Use a firewall to block access to the servers

Conduct a manual audit of each server every six months

Implement configuration management tools that enforce the baseline and alert on drift

Rely on the system administrators to follow the baseline manually

An attacker discovers that the web application's error page reveals the full SQL query and database table names. The attacker uses this information to craft a SQL injection attack that extracts sensitive data. Which misconfiguration chain is being exploited?

Unnecessary features such as directory listing

Verbose error messages enabling targeted SQL injection

Default credentials allowing database access

Insecure file permissions exposing configuration files

EC-CouncilWeb Application Hacking and Security

Domain 6Objective 1

Security Misconfigurations WAHS Practice Questions (Page 4)

Part of the Security Misconfiguration domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~19–31 in this domain), expect 6–10 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

5concepts

Questions 16–20

16application · medium
A security analyst is evaluating the impact of a misconfiguration where the web application's admin panel is accessible without authentication. Which of the following is the most likely impact?
Select an answer first
17application · medium
A security team wants to identify misconfigurations in their web server configuration, application framework settings, and database permissions. They need a method that can be repeated regularly and does not require manual review of every configuration file. Which approach best meets this requirement?
Select an answer first
18application · medium · select all that apply
A security team is performing a misconfiguration assessment of a web application. Which of the following are effective techniques for detecting security misconfigurations? Select all that apply.
Select an answer first
19application · medium
A company's security policy requires that all web servers be configured according to a hardened baseline. The security team needs to ensure that any deviation from the baseline is detected and corrected quickly. Which approach is most effective?
Select an answer first
20expert · hard
An attacker discovers that the web application's error page reveals the full SQL query and database table names. The attacker uses this information to craft a SQL injection attack that extracts sensitive data. Which misconfiguration chain is being exploited?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.