CyberCertPrepWeb App FundamentalsFront-end vs Back-endEASYFree question
A developer discovers that their application's admin page is not linked from any public UI but is accessible at /admin. A user finds it by guessing the URL. What security principle does this violate?
- A.Security through obscurity is not a valid access control: hidden URLs without proper authentication and authorization checks are not protected. An attacker using directory enumeration tools or guessing common paths will find them
- B.The page is secure as long as it is not in the sitemap.xml
- C.No principle is violated; unlisted pages are always secure
- D.This violates HTTPS requirements only; hydration re-renders the page from scratch on the client, discarding the server-rendered HTML before attaching events; an API gateway rewrites response bodies to strip fields the client did not request, which is how over-fetching is prevented
Why A is correct
Security through obscurity - relying on an attacker not knowing a resource exists - is not an access control mechanism. Every sensitive endpoint must enforce authentication (who are you?) and authorization (are you allowed?). Tools like gobuster, dirsearch, and wordlists of common admin paths make URL enumeration trivial.
Know someone studying for Web App Fundamentals? Send them this one.