MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

1. What is a directory traversal attack?
   a. A method to improve server speed
   b. A way to gain unauthorized access to files outside intended directories
   c. A tool for data encryption
   d. A network routing technique
   Answer: blearn.snyk+2
2. What is another common name for directory traversal?
   a. Command injection
   b. Path traversal
   c. SQL injection
   d. Cookie poisoning
   Answer: bportswigger+2
3. Which HTTP element is often manipulated in a directory traversal attack?
   a. Cookie value
   b. File path parameter
   c. Page title
   d. HTML tag
   Answer: bbrightsec+2
4. In a Linux environment, what does the ‘../’ sequence do?
   a. Moves up one directory
   b. Executes a script
   c. Encrypts a file
   d. Makes a new directory
   Answer: averacode+1
5. Which file might attackers try to access on a Linux system using directory traversal?
   a. /etc/passwd
   b. /usr/bin/java
   c. /var/log/httpd
   d. /tmp/newfile
   Answer: ageeksforgeeks+2
6. What file could be a target for directory traversal on a Windows server?
   a. win.ini
   b. hostsx
   c. passwd
   d. query.conf
   Answer: aacunetix+1
7. What is the default root directory for web documents on IIS (Windows)?
   a. C:\Users\Default
   b. C:\Inetpub\wwwroot
   c. C:\Program Files\Website
   d. C:\Root\Web
   Answer: bacunetix
8. Why are directory traversal vulnerabilities dangerous?
   a. They allow attackers to shut down the web server
   b. Attackers can access sensitive files outside the web root
   c. Only slow down the application
   d. Only work on outdated systems
   Answer: blearn.snyk+2
9. What programming languages can have directory traversal flaws?
   a. Only PHP
   b. Python and PHP
   c. Any language handling file paths
   d. Only compiled languages
   Answer: cveracode
10. What is a common prevention method for directory traversal?
    a. Disabling cookies
    b. Validating user input
    c. Enabling JavaScript
    d. Minimizing URL length
    Answer: bimperva+2
11. Which character sequence is commonly used in directory traversal attacks?
    a. ///
    b. ../
    c. ::
    d. **
    Answer: bportswigger+2
12. If a web app appends user input to a file path, what should it do to prevent traversal?
    a. Trust the input
    b. Sanitize and validate the input
    c. Compress the file
    d. Encrypt all content
    Answer: bbrightsec+2
13. What is the goal of many directory traversal attacks?
    a. Access user credentials or configuration files
    b. Crash the browser
    c. Redirect traffic
    d. Log users out
    Answer: abrightsec+1
14. What is one risk of exposing application logs via directory traversal?
    a. Performance boost
    b. Information disclosure
    c. Data compression
    d. Automatic patching
    Answer: bimperva+1
15. Which URL could be a directory traversal attempt?
    a. /download.php?file=report.txt
    b. /download.php?file=../../etc/passwd
    c. /index.php?page=home
    d. /home/user
    Answer: binvicti+2
16. What does ‘path normalization’ do?
    a. Makes all file paths lowercase
    b. Converts all slashes to backslashes
    c. Cleans up file paths to remove traversal characters
    d. Encrypts file paths
    Answer: cacunetix+1
17. What is ‘URL encoding’ in context of traversal attacks?
    a. Compresses the content
    b. Hides traversal strings using codes like %2e%2e/
    c. Optimizes website speed
    d. Creates new files
    Answer: bveracode+1
18. Which HTTP method is commonly involved in traversal vulnerabilities?
    a. POST
    b. GET
    c. PUT
    d. TRACE
    Answer: blearn.snyk+1
19. Directory traversal can be detected by observing which log activity?
    a. Repeated failed logins
    b. Unusual file access patterns with ‘../’
    c. Session timeouts
    d. Slow response times
    Answer: bimperva+1
20. Which access control is bypassed by directory traversal?
    a. Role-based access
    b. IP filtering
    c. Root directory restriction
    d. BitLocker encryption
    Answer: cveracode+1
21. Directory traversal can lead to which additional vulnerability?
    a. Cross-site scripting
    b. File inclusion (LFI/RFI)
    c. SQL tuning
    d. DLL injection
    Answer: bowasp+1
22. What is one way to detect directory traversal flaws during development?
    a. Conduct code reviews for path handling
    b. Only use GET requests
    c. Log all access attempts
    d. Disable log files
    Answer: ahackerone+2
23. What does the term ‘web root’ mean?
    a. The root file on a user’s PC
    b. The top-most directory on a web server serving files to users
    c. The location of user passwords
    d. The main page of a site
    Answer: bacunetix+1
24. Which user-supplied data should be sanitized for traversal risks?
    a. Only image uploads
    b. Any file path or filename in input, URL, or cookie
    c. Only admin fields
    d. Email addresses only
    Answer: bportswigger+1
25. Why do attackers try multiple ‘../’ in their attempts?
    a. To open more files in one request
    b. To determine the depth needed to reach sensitive files
    c. To speed up the server
    d. To close sessions
    Answer: bimperva+1
26. What is one sign of a vulnerable web application?
    a. Shows error messages with file paths
    b. Rejects all user input
    c. Only supports PDFs
    d. Requires two-factor authentication
    Answer: ahelpcenter.trendmicro+2
27. Which response code might indicate successful directory traversal?
    a. 404 Not Found
    b. 200 OK and file download
    c. 302 Redirect
    d. 403 Forbidden
    Answer: bgeeksforgeeks
28. A well-secured web server should prevent which outcome?
    a. Normal file downloads by users
    b. Reading system files via URL manipulation
    c. Displaying a homepage
    d. Showing public content to all users
    Answer: blearn.snyk+1
29. Directory traversal attacks can exploit vulnerabilities in which server elements?
    a. Only database servers
    b. Application code and web server software
    c. Network switches
    d. Load balancers
    Answer: bveracode+1
30. Changing which property can mitigate traversal?
    a. Disabling root directory
    b. Keeping strict file path whitelisting
    c. Increasing disk space
    d. Reducing RAM usage
    Answer: bhackerone+1
31. What real-world case involved over 700,000 routers with a directory traversal bug?
    a. IIS web exploit
    b. Shenzhen Gongjin Electronics firmware flaw
    c. Linux kernel bug
    d. Microsoft Edge browser flaw
    Answer: binvicti
32. What does ‘LFI’ stand for in cyber security?
    a. Large File Inclusion
    b. Local File Inclusion
    c. Linux File Injection
    d. List File Information
    Answer: bbrightsec
33. On Windows, which character can separate directories in traversal?
    a. \
    b. /
    c. Both a and b
    d. :
    Answer: cacunetix+1
34. What is ‘percent encoding’ and its use in traversal?
    a. Using % symbols to denote non-standard characters in URLs
    b. Compressing data
    c. Setting permissions
    d. Disabling cookies
    Answer: aimperva+1
35. To protect against traversal, input should be:
    a. Explicitly checked against expected file names and locations
    b. Ignored
    c. Handled only on user side
    d. Kept unencrypted
    Answer: ahackerone+1
36. Which of these is a famous directory traversal CVE?
    a. CVE-2017-5638
    b. CVE-2021-41773
    c. CVE-2011-2462
    d. CVE-2014-6271
    Answer: binvicti
37. What directory might contain user password hashes on Linux?
    a. /usr/local
    b. /etc
    c. /var/tmp
    d. /opt
    Answer: bveracode+1
38. What might attackers do after finding a traversal bug?
    a. Attempt to escalate privileges or pivot to other attacks
    b. Abandon the attack
    c. Close all files
    d. Increase memory usage
    Answer: abrightsec+1
39. Which access list prevents unauthorized file access?
    a. ACL (Access Control List)
    b. URL list
    c. Log file
    d. Registry key
    Answer: aacunetix+1
40. Why can even old traversal vulnerabilities still be dangerous?
    a. Modern software is never vulnerable
    b. Vulnerabilities may be unpatched and used repeatedly
    c. They require expensive tools
    d. They only affect mobile devices
    Answer: binvicti
41. What is ‘dot-dot-slash’ attack?
    a. Using ../ repeatedly to move up directories
    b. Compressing log files
    c. Filling up disk space
    d. Injecting into SQL statements
    Answer: alearn.snyk+1
42. Why should error messages be vague on file access?
    a. To help attackers locate files
    b. To avoid disclosing directory structure
    c. To increase speed
    d. To reduce CPU load
    Answer: bhelpcenter.trendmicro
43. Directory traversal is categorized under which CWE?
    a. CWE-78
    b. CWE-22
    c. CWE-89
    d. CWE-119
    Answer: bimperva
44. What does ‘absolute path’ mean?
    a. Path from current directory
    b. Full file path from the root directory
    c. Relative path
    d. Compressed path
    Answer: bgeeksforgeeks+1
45. What is a ‘brute-force’ aspect of directory traversal attacks?
    a. Trying multiple possible filenames and directories
    b. Guessing user passwords
    c. Encrypting files rapidly
    d. Restarting the server
    Answer: ageeksforgeeks
46. Why might attackers target backup files using traversal?
    a. They are slower to access
    b. Might contain sensitive configuration and old credentials
    c. To compress data
    d. To update them
    Answer: bbrightsec+1
47. Which HTTP header could possibly be manipulated in a traversal attack?
    a. Host
    b. Referer
    c. Cookie
    d. Content-Type
    Answer: cbrightsec
48. Which web server suffered from a 2021 directory traversal CVE?
    a. Nginx
    b. Apache HTTP Server
    c. OpenSSH
    d. MySQL Server
    Answer: binvicti
49. Why is restricting file extensions helpful for traversal security?
    a. Only denies files with .exe
    b. Blocks potential execution of malicious or unwanted file types
    c. Shortens URL
    d. Reduces load on server
    Answer: bhackerone+1
50. What is an effective last-resort for containing directory traversal attacks?
    a. Application firewall and intrusion detection system (IDS)
    b. Disabling all file access
    c. Increasing password length
    d. Compressing all files
    Answer: ahackerone+1

1. https://learn.snyk.io/lesson/directory-traversal/
2. https://portswigger.net/web-security/file-path-traversal
3. https://owasp.org/www-community/attacks/Path_Traversal
4. https://brightsec.com/blog/directory-traversal/
5. https://www.geeksforgeeks.org/computer-networks/what-is-a-directory-traversal-attack/
6. https://www.veracode.com/security/directory-traversal/
7. https://www.acunetix.com/websitesecurity/directory-traversal/
8. https://www.imperva.com/learn/application-security/directory-traversal/
9. https://www.invicti.com/learn/directory-traversal-path-traversal/
10. https://www.hackerone.com/blog/preventing-directory-traversal-attacks-techniques-and-tips-secure-file-access
11. https://helpcenter.trendmicro.com/en-us/article/tmka-18751
12. https://aimcqs.com/data-structures
13. https://www.sumologic.com/glossary/directory-traversal
14. https://www.geeksforgeeks.org/quizzes/top-mcqs-on-graph-traversals-with-answers/
15. https://www.youtube.com/watch?v=99yJtmmtrJU
16. https://www.geeksforgeeks.org/quizzes/top-mcqs-on-tree-traversal-with-interview-question-and-answers/
17. https://testbook.com/objective-questions/mcq-on-tree-traversal–5eea6a1139140f30f369eb98
18. https://en.wikipedia.org/wiki/Directory_traversal_attack
19. https://blog.hackxpert.com/2024/03/directory-traversal-quick-guide
20. https://www.sanfoundry.com/postorder-traversal-multiple-choice-questions-answers-mcqs/