CYBERSECURITY-ARCHITECTURE-AND-ENGINEERING practice question 10 of 30

A corporate website is currently being redesigned, which leaves it vulnerable to security threats. Management does not want to provide an attacker…

Choose your answer, then check it against the explanation and the full breakdown below.

Domain Security Architecture

A corporate website is currently being redesigned, which leaves it vulnerable to security threats. Management does not want to provide an attacker with any information about the web server. Which strategy should be used to prevent an attacker from gaining unauthorized information?

Answer options

Correct Answer:

Explanation

The most direct strategy to prevent an attacker from gaining information about the web server is to obfuscate or customize error messages. Default server error messages (e.g., 404, 500) and server response headers often leak sensitive details, such as the server software (Apache, IIS), version numbers, and underlying frameworks. This information is valuable for an attacker during the reconnaissance phase to identify potential vulnerabilities. By replacing default messages with generic, custom error pages and sanitizing server headers, the organization directly addresses the management's goal of preventing this specific type of information leakage.

Why Incorrect

B. Enabling Hypertext Transfer Protocol Secure (HTTPS) over Domain Name Service (DNS): This technology (DNS over HTTPS or DoH) encrypts DNS queries to protect user privacy from network eavesdroppers; it does not hide information about the target web server itself.

C. Using HTTPS for all page and content requests: HTTPS encrypts data in transit, preventing man-in-the-middle attacks. However, it does not prevent the server from sending detailed error messages or headers to an attacker within the encrypted session.

D. Becoming PCI-DSS compliant and certified: PCI-DSS is a broad compliance framework focused on protecting cardholder data. While it requires secure configurations, it is not a specific strategy aimed solely at preventing server information disclosure.

---

References

1. OWASP Foundation. (2021). OWASP Top 10:2021, A05:2021 – Security Misconfiguration. OWASP. Retrieved from https://owasp.org/Top10/A052021-SecurityMisconfiguration/.

Reference Detail: The document states, "An application might be vulnerable if you are... exposing stack traces or other overly informative error messages to users." This directly supports the principle of obfuscating error messages to prevent information leakage.

2. National Institute of Standards and Technology (NIST). (2007). NIST Special Publication 800-95: Guide to Secure Web Services.

Reference Detail: Section 4.3.3, "Exception Handling," advises that "SOAP Faults can reveal implementation details of the web service... Exception handling logic should be careful not to return sensitive system information to a client such as stack traces..." This principle applies directly to web server error handling in general.

3. Apache HTTP Server Project. (n.d.). Core Features - ServerTokens Directive. Apache HTTP Server Version 2.4 Documentation.

Reference Detail: The documentation for the ServerTokens directive explains how it controls the information the server sends back in the Server response header. Setting it to Prod (ServerTokens Prod) is recommended to send only "Apache," preventing the disclosure of version and module information, which is a form of information obfuscation.

Question 10 of 30

Question breakdown

Tests: Prevent web server information disclosure
Difficulty: Easy

Key idea: Generic, sanitized error messages and headers deny attackers reconnaissance details such as server type, version and stack traces.

How to reach the answer

The goal is to avoid giving attackers information about the web server.
Default error pages and headers leak software names, versions and paths.
Obfuscating or customizing error output removes that leakage.
HTTPS, DoH and PCI-DSS address other concerns: transport, DNS privacy and cardholder data.

Each option

ACorrect. Generic error messages and clean URLs stop the site from revealing server details to attackers.
BIncorrect. DNS over HTTPS protects the privacy of DNS lookups, not the server's identity details.
CIncorrect. HTTPS encrypts traffic, but an attacker on the other end still receives any verbose errors the server sends.
DIncorrect. PCI-DSS is a broad cardholder-data compliance standard, not a targeted information-disclosure control.

Common trap: HTTPS feels like the default security answer, but encryption hides data from eavesdroppers, not from the attacker who is making the requests.

In practice: Hardening checklists set Apache ServerTokens Prod/ServerSignature Off and IIS custom error pages, and they disable stack traces in production frameworks.

Remember: To deny attackers reconnaissance, suppress verbose errors and version banners; encryption does not do this.

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free CYBERSECURITY-ARCHITECTURE-AND-ENGINEERING practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test