A development team wants to prevent security misconfigurations from being introduced during deployment. They use infrastructure as code (IaC) to manage their web servers. Which practice is most effective for this goal?

Disable all security features to simplify the configuration.

Use a configuration baseline and automated scanning of the IaC templates before deployment.

Rely on the cloud provider's default security settings.

Perform regular manual audits of the production servers.

A security analyst discovers that a web application's error page displays the full SQL query, database table names, and the application's internal file path. An attacker could use this information to craft a targeted SQL injection attack. Which of the following best describes the primary impact of this misconfiguration?

No impact because error messages are only shown to authenticated users

Loss of availability because the error page crashes the server

Increased risk to confidentiality and integrity because the leaked details facilitate targeted attacks

Immediate loss of integrity because the error page modifies database records

A web application has a feature that allows users to export data as a PDF. The server uses a library that is outdated and has known vulnerabilities. An attacker exploits this to read arbitrary files from the server. Which misconfiguration is the root cause?

The application does not use HTTPS.

The application does not validate user input before passing it to the PDF library.

The server has directory listing enabled.

The server uses an outdated library with known vulnerabilities.

A tester discovers that the web application's server header reveals the exact version of the web server software. The tester uses this information to search for known vulnerabilities for that version. Which misconfiguration is being exploited?

Information disclosure via server headers

EC-CouncilWeb Application Hacking and Security

Domain 6Objective 1

Security Misconfigurations WAHS Practice Questions (Page 9)

Part of the Security Misconfiguration domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~19–31 in this domain), expect 6–10 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

5concepts

Questions 41–44

41application · medium
A development team wants to prevent security misconfigurations from being introduced during deployment. They use infrastructure as code (IaC) to manage their web servers. Which practice is most effective for this goal?
Select an answer first
42application · medium
A security analyst discovers that a web application's error page displays the full SQL query, database table names, and the application's internal file path. An attacker could use this information to craft a targeted SQL injection attack. Which of the following best describes the primary impact of this misconfiguration?
Select an answer first
43application · medium
A web application has a feature that allows users to export data as a PDF. The server uses a library that is outdated and has known vulnerabilities. An attacker exploits this to read arbitrary files from the server. Which misconfiguration is the root cause?
Select an answer first
44application · medium
A tester discovers that the web application's server header reveals the exact version of the web server software. The tester uses this information to search for known vulnerabilities for that version. Which misconfiguration is being exploited?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.

Security Misconfigurations WAHS Practice Questions (Page 9)

Questions 41–44

A development team wants to prevent security misconfigurations from being introduced during deployment. They use infrastructure as code (IaC) to manage their web servers. Which practice is most effective for this goal?

A web application has a feature that allows users to export data as a PDF. The server uses a library that is outdated and has known vulnerabilities. An attacker exploits this to read arbitrary files from the server. Which misconfiguration is the root cause?

A tester discovers that the web application's server header reveals the exact version of the web server software. The tester uses this information to search for known vulnerabilities for that version. Which misconfiguration is being exploited?

Keep studying — Security Misconfiguration