Eccouncil ECSS Exam - Topic 10 Question 110 Discussion

Actual exam question for Eccouncil's ECSS exam

Question #: 110
Topic #: 10

[All ECSS Questions]

Melanie, a professional hacker, is attempting to break into a target network through an application server. In this process, she identified a logic flaw in the target web application that provided visibility into the source code. She exploited this vulnerability to launch further attacks on the target web application.

Which of the web application vulnerabilities was identified by Melanie in the above scenario?

AInsecure deserialization

BSecurity misconfiguration

CCommand injection

DBroken authentication

Show Suggested Answer

Suggested Answer: B

Melanie discovered alogic flawin the target web application that allowed her to view thesource code. This flaw indicates asecurity misconfiguration, which can lead to further attacks.Security misconfigurations occur when an application or system is not properly configured, leaving it vulnerable to exploitation.Reference: EC-Council Certified Security Specialist (E|CSS) documents and study guide12.

by Louann at Aug 18, 2025, 06:54 PM

Limited Time Offer

25%

Off

Get Premium ECSS Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Shenika

2 months ago

Wait, are we sure it’s not broken authentication?

upvoted 0 times

...

Ngoc

3 months ago

I totally agree, that’s definitely a vulnerability!

upvoted 0 times

...

Rory

3 months ago

Insecure deserialization could fit too, but I lean towards misconfiguration.

upvoted 0 times

...

Paulene

3 months ago

Really? I’m surprised they missed such a basic flaw!

upvoted 0 times

...

Katina

3 months ago

Sounds like a classic case of security misconfiguration.

upvoted 0 times

...

Rory

3 months ago

Broken authentication seems off for this scenario. I lean towards security misconfiguration, but I wish I could remember more details from our last review session.

upvoted 0 times

...

Frederica

4 months ago

I practiced a question like this, and I feel like command injection was mentioned as a common attack vector, but it doesn't seem to fit here.

upvoted 0 times

...

Gabriele

4 months ago

I'm not entirely sure, but I remember something about insecure deserialization being a risk for exposing code. Could that be it?

upvoted 0 times

...

Theron

4 months ago

I think this might be related to security misconfiguration since she got access to the source code. That sounds like a setup issue.

upvoted 0 times

...

Julianna

4 months ago

I'm a bit confused here. The question mentions a "logic flaw" that provided visibility into the source code, but it's not clear which specific vulnerability that corresponds to. I'll need to review my notes on web application security to figure this one out.

upvoted 0 times

...

Gerald

4 months ago

Okay, I think I've got this. Based on the information provided, the vulnerability Melanie identified was likely a broken authentication or access control issue that gave her unauthorized access to the source code.

upvoted 0 times

...

Anastacia

5 months ago

Hmm, this is a tricky one. I'll need to carefully analyze the details to determine the exact vulnerability. Could be something like a misconfiguration or even a command injection issue.

upvoted 0 times

...

Diego

5 months ago

This sounds like a classic case of a vulnerability in the web application's logic. I'd focus on identifying the specific flaw that allowed Melanie to gain visibility into the source code.

upvoted 0 times

...

Tamekia

5 months ago

I believe it could also be Broken authentication, as that could lead to further attacks.

upvoted 0 times

...

Lashaunda

5 months ago

I agree with Brock, Security misconfiguration makes sense in this scenario.

upvoted 0 times

...

Brock

6 months ago

I think the vulnerability identified by Melanie is Security misconfiguration.

upvoted 0 times

...

Marsha

7 months ago

Whoa, Melanie's got some serious hacking skills! I bet she could take down my school's website in seconds. I'd go with C - Command injection, that's some classic hacker stuff right there.

upvoted 0 times

...