Certified Ethical Hacker (CEH) Practice Question

Directory and file enumeration, content discovery, and inspection of publicly reachable application resources are performed in the "Analyze web applications" phase. By this point the tester has already completed infrastructure footprinting and now focuses on mapping the application's internal structure (hidden directories, configuration files, comments, parameters, etc.). Phases such as "Footprint web infrastructure," "Bypass client-side controls," and "Attack authentication mechanisms" address different objectives and therefore are not appropriate for evaluating an exposed web.xml file.