CyberCertPrepWeb App FundamentalsWeb Servers & DeploymentEASYFree question
An operations team finds a backup file 'database_2023_backup.sql' in the web server's public document root. What is the immediate risk?
- A.The backup file takes up disk space
- B.Anyone on the internet can download the full database dump, which likely contains user credentials (even hashed), PII, financial data, and the entire application's data - a catastrophic data breach
- C.Backup files cannot be served by web servers
- D.The risk is only a disk performance impact
Why B is correct
Files in the web root are served to anyone who requests them. A database backup file contains the entire application dataset. Common backup file discovery is automated by scanners using wordlists (db.sql, backup.tar.gz, dump.sql, *.bak). Best practice: backup files must never be stored in the webroot; backups should be stored in access-controlled storage (private S3 bucket, separate server with auth).
Know someone studying for Web App Fundamentals? Send them this one.