Quiz — Security Misconfiguration
10 APPLY on A02: defaults, headers, clickjacking, demo http://192.168.0.1/ ethics.
Security Misconfiguration — Module Quiz
Ten APPLY items on OWASP Top 10:2025 A02: insecure defaults and debug, directory listings and open surfaces, CSP/nosniff/HSTS literacy, clickjacking frame defenses, broken vs hard on HOST , $HOME/cyberlium-lab notes chmod 600.
APPLY: Production still serves a full stack trace and /debug. What A02 issue is that?
APPLY: True or False: Default admin/admin is fine if the password is in the vendor docs.
APPLY: Directory listing shows a forgotten backup folder on YOUR lab. What do you ship?
APPLY: Which header set best matches this module’s hard mode literacy?
APPLY: True or False: BeEF is the assigned way to prove CSP in Cyberlium A02.
APPLY: A confirm-pay page is frameable by any site. What failed?
APPLY: True or False: Sending HSTS on a plain HTTP lab fully enables HSTS for browsers.
APPLY: curl http://192.168.0.1/ shows a TP-Link/Netgear “Router Admin” login. What do you do?
APPLY: A teammate wants to Shodan open buckets “for A02 cloud.” What do you say?
APPLY: You finish A02. What opens next, and what is Cyberlium legally?