A web application you are testing has directory listing enabled, exposing sensitive files. What should you recommend to mitigate this?

Question

Options

• ADisable directory listing in the web server configuration
• BIncrease the server timeout threshold
• CEnable verbose error logging
• DRestrict administrative access to internal users only

• A
  80% (16)
• B
  5% (1)
• C
  10% (2)
• D
  5% (1)

Explanation

Disabling directory listing in the web server configuration (A) directly removes the vulnerability by preventing the server from automatically rendering a browsable file index when no default document exists - this is a one-line config change in Apache (Options -Indexes) or Nginx (autoindex off) that closes the exposure at its source.

Why the distractors are wrong:

• B (Increase server timeout) addresses request handling performance, not information disclosure - timeouts have no bearing on what the server reveals about its file structure.
• C (Enable verbose error logging) actually worsens the attack surface by potentially exposing internal paths, stack traces, and system details to an attacker.
• D (Restrict admin access to internal users) is a valid hardening step in general, but directory listing is typically exploitable by any unauthenticated visitor, not just admins - restricting admin access doesn't fix public-facing directory exposure.

Memory tip: Think "fix the feature, not around it." Directory listing is a web server feature that's been accidentally left on - the fix is always to turn off that specific feature in the server config, not to compensate with unrelated controls.

No community discussion yet for this question.