Security Misconfigurations WAHS Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   An attacker exploits a misconfiguration that allows directory listing on a web server. What is the most likely immediate outcome?

   • AThe attacker can modify the files in the directory
   • BThe attacker can execute arbitrary code on the server
   • CThe attacker can bypass authentication on the application
   • DThe attacker can view the list of files in the directory
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A web application has an 'upload' feature that allows users to upload profile pictures. The server does not validate file types and stores uploads in a publicly accessible directory. What is the most likely impact of this misconfiguration?

   • AAn attacker can upload a malicious script and execute it on the server.
   • BAn attacker can perform a denial-of-service attack by uploading large files.
   • CAn attacker can read other users' profile pictures.
   • DAn attacker can modify the server's configuration files.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A web application returns detailed stack traces to users when an error occurs. An attacker exploits this to learn the database schema and framework version, then crafts a SQL injection attack. What is the primary impact of the verbose error misconfiguration?

   • ALoss of availability because the error messages cause the server to crash.
   • BLoss of confidentiality because sensitive technical details are disclosed to unauthorized users.
   • CLoss of integrity because the attacker can modify error messages.
   • DLoss of accountability because the logs are not recorded.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A penetration tester is assessing a web application that uses a popular open-source content management system. The tester navigates to /admin and is presented with a login page that displays the CMS version number and a 'Forgot password' link. The tester attempts the default administrator credentials 'admin:admin' and successfully logs in. Which security misconfiguration is most directly demonstrated by this scenario?

   • ADefault credentials left unchanged
   • BVerbose error messages revealing stack traces
   • CMissing security headers in HTTP responses
   • DUnnecessary features enabled, such as directory listing
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security team needs to detect misconfigurations in a web application that is behind a content delivery network (CDN). The CDN caches responses and may hide the origin server's behavior. Which technique is most effective for detecting misconfigurations in this environment?

   • ABypass the CDN by accessing the origin server directly
   • BReview the CDN's caching rules
   • CDisable the CDN temporarily
   • DScan the CDN's IP addresses for vulnerabilities
   Reveal Solution Discussion Select an answer first