A security engineer wants to detect misconfigurations in their web application's framework settings, such as debug mode being enabled in production, insecure cookie flags, and unnecessary HTTP methods. Which technique would be most effective for this purpose?

Check the web server logs for error patterns

Ask the development team to confirm the settings

Use an automated web application scanner with configuration checks

Review the application's source code manually

A security analyst is assessing the impact of a misconfiguration where the web application's backup files are stored in a publicly accessible directory. The backup files contain the entire database dump. Which of the following is the most severe impact?

Complete loss of confidentiality of all user data

Loss of availability of the application

Temporary denial of service due to high traffic

Modification of the backup files by attackers

A web application has an admin panel that is accessible at /admin. The application uses a default session cookie name and does not invalidate sessions after logout. An attacker steals a session cookie and gains admin access. Which misconfiguration is the root cause?

The admin panel is not protected by a CAPTCHA.

The application uses a default session cookie name and does not invalidate sessions on logout.

The application does not implement rate limiting on the login form.

A security analyst is tasked with detecting misconfigurations in a database server that supports a web application. Which technique is most effective for identifying weak authentication settings?

Check the database server's version banner.

Attempt to connect using default or weak credentials.

Review the web application's source code for SQL queries.

Perform a network scan to find open ports.

An attacker exploits a misconfiguration where the web server allows the TRACE method. The attacker uses this to perform a cross-site tracing (XST) attack to steal cookies. Which misconfiguration is being exploited?

Unnecessary HTTP methods enabled

EC-CouncilWeb Application Hacking and Security

Domain 6Objective 1

Security Misconfigurations WAHS Practice Questions (Page 8)

Part of the Security Misconfiguration domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~19–31 in this domain), expect 6–10 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

5concepts

Questions 36–40

36application · medium
A security engineer wants to detect misconfigurations in their web application's framework settings, such as debug mode being enabled in production, insecure cookie flags, and unnecessary HTTP methods. Which technique would be most effective for this purpose?
Select an answer first
37expert · hard
A security analyst is assessing the impact of a misconfiguration where the web application's backup files are stored in a publicly accessible directory. The backup files contain the entire database dump. Which of the following is the most severe impact?
Select an answer first
38application · medium
A web application has an admin panel that is accessible at /admin. The application uses a default session cookie name and does not invalidate sessions after logout. An attacker steals a session cookie and gains admin access. Which misconfiguration is the root cause?
Select an answer first
39application · medium
A security analyst is tasked with detecting misconfigurations in a database server that supports a web application. Which technique is most effective for identifying weak authentication settings?
Select an answer first
40application · medium
An attacker exploits a misconfiguration where the web server allows the TRACE method. The attacker uses this to perform a cross-site tracing (XST) attack to steal cookies. Which misconfiguration is being exploited?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.