CEH Web Application and Injection Attacks Practice Question
An organization wants to prevent directory listing on its Apache web server. Which of the following configuration changes would achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set 'Options -Indexes' in the httpd.conf or .htaccess file
Disabling the Indexes option in the Directory directive prevents Apache from listing directory contents when no index file exists.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set 'AllowOverride None'
Why it's wrong here
The 'AllowOverride None' directive is used in Apache's main configuration files (like httpd.conf) to prevent the server from processing any directives found in .htaccess files within a given directory and its subdirectories. While this can be a security hardening measure by restricting per-directory configuration changes, it does not inherently disable directory listing. If the 'Indexes' option is enabled in the main server configuration, setting 'AllowOverride None' will simply prevent a .htaccess file from overriding that setting to disable 'Indexes', thus directory listing would persist.
- ✗
Set 'ServerSignature Off'
Why it's wrong here
The 'ServerSignature Off' directive is primarily used to suppress the display of Apache server version and operating system information from error pages and directory listings. Its main purpose is to reduce information disclosure that could assist attackers in identifying specific vulnerabilities associated with known server versions. However, this directive does not prevent the directory listing itself from being displayed; it merely removes the server signature from the footer of such pages, leaving the directory contents visible.
- ✓
Set 'Options -Indexes' in the httpd.conf or .htaccess file
Why this is correct
The 'Options -Indexes' directive explicitly disables the automatic generation of directory listings when a default index file (such as index.html or index.php) is not found within a directory. By removing the 'Indexes' option, the web server is configured to return a '403 Forbidden' error instead of displaying the contents of the directory to the client. This is the direct and intended method for preventing directory browsing in Apache, effectively mitigating information disclosure risks.
- ✗
Set 'DirectoryIndex disabled'
Why it's wrong here
The 'DirectoryIndex disabled' directive prevents Apache from looking for and serving default index files (e.g., index.html, index.php) when a directory is requested. Instead of serving a default file, if the 'Indexes' option is still enabled for that directory, the server will proceed to generate and display a directory listing. Therefore, this setting alone does not prevent directory listing; it merely ensures no default file is served, potentially exacerbating the problem by making directory listings more likely if 'Indexes' is active.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a penetration test, the tester finds that the Apache server is configured with directory listing enabled on the /uploads directory. The tester navigates to http://example.com/uploads/ and sees a list of files. Which of the following is the MOST immediate security concern?
hard- ✓ A.Sensitive files may be exposed to unauthorized users
- B.The server is running an outdated version of Apache
- C.The server is vulnerable to cross-site scripting (XSS) attacks
- D.An attacker can upload malicious files to the directory
Why A: Directory listing exposes file names that may reveal sensitive information (e.g., backup files, config files). Attackers can then attempt to access these files directly, potentially leading to data disclosure.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.