CyberCertPrepWeb App FundamentalsFront-end vs Back-endEASYFree question
A developer discovers that their application's admin page is not linked from any public UI but is accessible at /admin. A user finds it by guessing the URL. What security principle does this violate?
- A.No principle is violated; unlisted pages are always secure
- B.The page is secure as long as it is not in the sitemap.xml
- C.Security through obscurity is not a valid access control: hidden URLs without proper authentication and authorization checks are not protected. An attacker using directory enumeration tools or guessing common paths will find them
- D.This violates HTTPS requirements only
Why C is correct
Security through obscurity - relying on an attacker not knowing a resource exists - is not an access control mechanism. Every sensitive endpoint must enforce authentication (who are you?) and authorization (are you allowed?). Tools like gobuster, dirsearch, and wordlists of common admin paths make URL enumeration trivial.
Know someone studying for Web App Fundamentals? Send them this one.