CEH Web Application and Injection Attacks Practice Question
Which OWASP Top 10 (2021) category describes the vulnerability where an application allows an attacker to include a remote file from an external server, leading to code execution or data disclosure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Injection (A03:2021)
Injection (A03:2021) covers various injection flaws, including Remote File Inclusion (RFI). RFI is a type of injection where user input is used to include a remote file, leading to code execution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Security Misconfiguration (A05:2021)
Why it's wrong here
Security Misconfiguration (A05:2021) encompasses vulnerabilities arising from insecure default configurations, incomplete or unpatched systems, unnecessary features enabled, or misconfigured HTTP headers. It specifically pertains to the improper setup and hardening of the application stack, rather than how user-supplied input directly manipulates application logic or interpreters. This is distinct from injection, which exploits input processing.
- ✓
Injection (A03:2021)
Why this is correct
Injection vulnerabilities occur when untrusted data is sent to an interpreter as part of a command or query without proper validation or sanitization. This allows an attacker to trick the interpreter into executing unintended commands, accessing unauthorized data, or including arbitrary files. Remote File Inclusion (RFI) is a prime example, where an attacker can force the application to include and execute malicious remote files, often leading to remote code execution.
- ✗
Broken Access Control (A01:2021)
Why it's wrong here
Broken Access Control (A01:2021) describes vulnerabilities where an application fails to properly enforce restrictions on what authenticated users are authorized to do. It involves issues like horizontal privilege escalation, allowing users to access other users' data, or vertical privilege escalation, enabling standard users to perform administrative functions. The problem lies in inadequate authorization checks, not in the processing of malicious input by an interpreter.
- ✗
Cryptographic Failures (A02:2021)
Why it's wrong here
Cryptographic Failures (A02:2021) arise when sensitive data is not adequately protected, either in transit or at rest, due to weak or absent encryption, poor key management, or outdated cryptographic algorithms. This can lead to the exposure of confidential information. The core issue is the inadequate application of cryptographic controls to safeguard data, which is fundamentally different from exploiting input parsing.
Go deeper
Related to this question
Learn chapter
Vulnerability Analysis
Key term
File Inclusion Attacks
File inclusion attacks exploit web application vulnerabilities to load remote or local files, often allowing attackers to execute code, steal data, or compromise a server.
Key term
OWASP Top 10
The OWASP Top 10 is a regularly updated list of the most critical security risks to web applications, published by the Open Web Application Security Project (OWASP) to help developers and security professionals prioritize and mitigate common vulnerabilities.
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.