A security audit finds that a web server has directory listing enabled for the /uploads/ directory. An attacker visits the URL. What can they see?

• A.The attacker sees an index of the newest uploaded files, sorted by date, and every older file stays hidden until the log rotation runs at midnight, a limit applied by the directory listing module
• B.The attacker sees the contents of each file in the directory rendered inline, and all PHP files run on the server when the listing opens, a side effect that returns script output in place of the index
• C.The attacker sees an HTML index of all files in the directory - uploaded files, configuration files, backup files, and any other content stored there - without needing to know specific filenames
• D.The attacker sees a 403 error page, and all files stay protected unless a filename is guessed, a rule enforced by the web server