A security team wants to detect misconfigurations in their web application's framework, such as debug mode being enabled in production. Which technique would be most effective?

Review the application's source code for debug flags.

Use a port scanner to identify open ports on the server.

Send malformed requests and observe the error responses for stack traces or debug information.

Check the HTTP response headers for the 'X-Powered-By' header.

What is the purpose of conducting regular security audits of web application configurations?

To increase the number of features enabled by default

To ensure that error messages are as detailed as possible

To identify and remediate misconfigurations before they are exploited

To document all default credentials for future use

A security team is responsible for hardening a web application that has multiple misconfigurations, including default credentials, verbose error messages, and unnecessary features. The team has limited resources and must prioritize remediation. Which misconfiguration should be addressed first?

All should be addressed simultaneously

Which of the following is a common security misconfiguration in web applications?

Enabling directory listing on the web server

Implementing multi-factor authentication for admin users

Using parameterized queries to prevent SQL injection

An attacker discovers that the web application's backup files are stored in a publicly accessible directory. The attacker downloads a backup file that contains the application's configuration file with database credentials. Which misconfiguration is being exploited?

Missing authentication on the admin panel

Default credentials on the database

Sensitive data exposure due to insecure file storage

EC-CouncilWeb Application Hacking and Security

Domain 6Objective 1

Security Misconfigurations WAHS Practice Questions (Page 6)

Part of the Security Misconfiguration domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~19–31 in this domain), expect 6–10 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

5concepts

Questions 26–30

26application · medium
A security team wants to detect misconfigurations in their web application's framework, such as debug mode being enabled in production. Which technique would be most effective?
Select an answer first
27foundation · easy
What is the purpose of conducting regular security audits of web application configurations?
Select an answer first
28expert · hard
A security team is responsible for hardening a web application that has multiple misconfigurations, including default credentials, verbose error messages, and unnecessary features. The team has limited resources and must prioritize remediation. Which misconfiguration should be addressed first?
Select an answer first
29foundation · easy
Which of the following is a common security misconfiguration in web applications?
Select an answer first
30application · medium
An attacker discovers that the web application's backup files are stored in a publicly accessible directory. The attacker downloads a backup file that contains the application's configuration file with database credentials. Which misconfiguration is being exploited?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.