CyberCertPrepWeb App FundamentalsWeb Servers & DeploymentEASYFree question
A security engineer reviews an Apache web server configuration and finds 'Options +Indexes' in the .htaccess file. What is this setting and what is the recommended change?
- A.Options +Indexes enables Apache to process PHP files; it should be changed to PHP-FPM
- B.Options +Indexes only applies to the root directory, not subdirectories
- C.Options +Indexes increases web server performance for static assets
- D.Options +Indexes enables directory listing: if a directory has no index file (index.html, index.php), Apache will display a file listing of the directory contents. This can expose source code, configuration files, backup files, and internal directory structure. Change to 'Options -Indexes' to return 403 Forbidden instead of a directory listing
Why D is correct
Directory listing (Options Indexes in Apache, autoindex in Nginx) is a common security misconfiguration. When enabled and no index file exists, the server displays all files in the directory. Attackers can discover: backup files (*.bak, *.old), source code, configuration files, log files, and internal directories. Always disable directory listing in production. Apache: 'Options -Indexes'; Nginx: 'autoindex off;'. Additionally, ensure backup/temporary files are not stored in web-accessible directories.
Know someone studying for Web App Fundamentals? Send them this one.