Which actions help secure configuration settings in web applications? (Choose two)

Question

Options

• AUsing secure default settings
• BEnabling verbose logging for all users
• CDisabling directory listing
• DAllowing all file uploads

• A
  84% (21)
• B
  4% (1)
• D
  12% (3)

Explanation

Using secure default settings (A) ensures that applications start in a hardened state without requiring manual intervention - misconfigurations are one of the leading causes of web application vulnerabilities (OWASP A05). Disabling directory listing (C) prevents attackers from browsing server file structures, which can expose sensitive files, backup scripts, or configuration data that aid reconnaissance.

Verbose logging for all users (B) is wrong because it can expose sensitive data (tokens, passwords, PII) in logs and gives attackers a roadmap if logs are compromised - logging should be scoped and access-controlled. Allowing all file uploads (D) is wrong because unrestricted uploads enable attackers to upload malicious files (web shells, malware), leading to remote code execution.

Memory tip: Think "lock the door before guests arrive" - secure defaults (A) and hiding the directory map (C) are both about minimizing exposure before an attacker even knocks. The distractors (verbose logs, open uploads) both increase attack surface rather than reduce it.

No community discussion yet for this question.