CEH Web Application and Injection Attacks Practice Question
A security analyst notices that a web application returns different HTTP responses for valid and invalid usernames during login. Which attack is this behavior most likely facilitating?
⚠ Common exam trap
CEH often tests the confusion between username enumeration and brute force — enumeration identifies valid accounts via response differences, while brute force attempts to guess credentials; the question's focus on differing responses signals enumeration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Username enumeration
When a login endpoint returns distinguishable responses (different status codes, messages, or timing) for valid versus invalid usernames, an attacker can systematically probe the endpoint to build a list of valid accounts. This behavior is the defining characteristic of username enumeration. It is a reconnaissance technique that precedes brute-force or credential-stuffing attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Username enumeration
Why this is correct
Username enumeration occurs when a web application's login mechanism provides distinct responses or behaviors for valid versus invalid usernames. This difference, which could manifest as varying HTTP status codes, specific error messages (e.g., "Username exists" vs. "Invalid credentials"), or even subtle timing discrepancies, allows an attacker to systematically test usernames and identify which ones correspond to existing accounts. Once valid usernames are identified, they become targets for subsequent brute-force attacks or credential stuffing.
- ✗
Cross-site scripting (XSS)
Why it's wrong here
Cross-site scripting (XSS) is a client-side code injection vulnerability where an attacker injects malicious scripts into web pages viewed by other users. This attack primarily aims to compromise user sessions, deface websites, or redirect users to malicious sites, operating within the victim's browser context. XSS does not exploit differences in server-side login responses to determine the validity of usernames; its mechanism is entirely distinct from account enumeration.
- ✗
Directory traversal
Why it's wrong here
Directory traversal, also known as path traversal, is an attack that exploits vulnerabilities in file path handling to access files and directories stored outside the intended web root directory. Attackers manipulate input parameters containing file paths (e.g., using `../` sequences) to navigate the server's file system and retrieve sensitive information or execute unauthorized files. This attack is focused on file system access and is entirely unrelated to observing login response differences for username enumeration.
- ✗
SQL injection
Why it's wrong here
SQL injection is a code injection technique used to manipulate or interfere with the queries an application makes to its database. Attackers insert malicious SQL statements into input fields to bypass authentication, extract sensitive data, or modify database content. While SQL injection can sometimes lead to authentication bypass or data exfiltration that might indirectly reveal usernames, the core mechanism described (observing distinct login responses for valid vs. invalid usernames) is not the direct or typical manifestation of a SQL injection vulnerability.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 913 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official EC-Council exam blueprint
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.