Multiple choice technology security

Certain folders in your application contain sensitive data. How would you securely hide their existence within your web application for all users?

  1. Send 403 return code

  2. Send 302 return code and redirect the user to the home page

  3. Send 404 return code

  4. Send 200 return code
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

Returning a 404 Not Found response instead of 403 Forbidden prevents information disclosure about directory existence. Attackers probing for sensitive folders learn nothing from 404 responses, whereas 403 responses confirm that something exists but is restricted, providing valuable reconnaissance information.

AI explanation

Returning a 404 Not Found for restricted paths makes them indistinguishable from paths that simply don't exist, so an attacker probing the site gets no signal that anything sensitive is there. A 403 Forbidden or a redirect both confirm the resource exists (just access is denied/rerouted), which leaks its existence, and a 200 would obviously expose it directly.

Keep practicing — related questions