Temporary files
-
Should be placed securely in a folder called “temp” in the web root
-
Can be placed anywhere in the web root as long as there are no links to them
-
Should be completely removed from the server
-
Can be placed anywhere after changing the extension
Temporary files often contain sensitive operational data and should be completely removed from the server to prevent info leakage. Leaving them in public folders like the web root, even without links or with modified extensions, exposes them to discovery by attackers utilizing directory brute-forcing or source disclosure exploits.
To answer this question, let's go through each option to understand why it is correct or incorrect:
Option A) Should be placed securely in a folder called “temp” in the web root - This option is incorrect. Placing temporary files in a folder called "temp" in the web root is not a secure practice. The web root is accessible to the public, and placing sensitive temporary files in this location can expose them to potential security risks.
Option B) Can be placed anywhere in the web root as long as there are no links to them - This option is incorrect. Placing temporary files anywhere in the web root, even without links to them, is still not a secure practice. As mentioned earlier, the web root is accessible to the public, and sensitive temporary files should not be stored in this location.
Option C) Should be completely removed from the server - This option is correct. A good practice is to completely remove temporary files from the server once they are no longer needed. This helps ensure that sensitive information stored in these files is not exposed to unauthorized access.
Option D) Can be placed anywhere after changing the extension - This option is incorrect. Changing the extension of a file does not provide any security. Temporary files should not be placed anywhere in the web root, regardless of their file extension.
The correct answer is C) Should be completely removed from the server. This option is correct because it follows the best practice of removing temporary files from the server to prevent unauthorized access and potential security risks.