Security Misconfiguration

The HTTP methods that can lead to security issues in a web application

[Multiple Choice]

• OPTIONS

• PUT

• DELETE

• TRACE

Banner can get leaked by:

[Multiple Choice]

• Port scan

• Server side error

• HTTP header

• None of the above

The Logs that should be used for monitoring:

• Database logs

• error logs

• access logs

• All of the above

Full form of CVE

• Commands for vulnerability exposure

• Cited Vulnerability and Exposures

• Common Vulnerabilities and Exposures

• None of the above

In the above CVEs, the most vulnerable version of Microsoft IIS server is:

• CVE-2014

• CVE-2009

• CVE-2008

• CVE-2007

Patching a vulnerable software may lead to:

• Misconfiguration of the software

• Securing of the software

• Degradation of the market value

• Lesser customers using the software

HTTP/1.1 200 OK

Date: Sat, 1 May 2010 21:10:40 EST

Server: Apache Tomcat 9.0.0.M1 (Unix) (Red Hat/Linux)

Last-Modified: Wed, 16 Mar 2010 11:20:14 PST

ETag: "1986-69b-123abc46"

Accept-Ranges: bytes

Content-Length: 1110

Connection: close

Content-Type: text/html

Which of the security misconfiguration this HTTP header is disclosing:

[Multiple Choice]

• Default password

• Logs

• Server Banner

• None of the above

Which headers can lead to CORS:

[Multiple Choice]

• Access-Control-Allow-Headers

• Access-Control-Request-Method

• Access-Control-Allow-Origin

• Access-Control-Allow-Credentials

To prevent security misconfigurations the developer should:

[Multiple Choice]

• Keep strong credentials

• Not expose server versions

• Whitelist domains/subdomains

• Disable insecure HTTP methods

PUT method can be used by an attacker:

• Download sensitive information from the application

• Upload files to the application

• Delete files from the application

• Non of the above