A civic application's FTP service allows anonymous listing during approved testing. How should the tester handle that result?
Select an answer to reveal the explanation.
Short Explanation
Anonymous listing is a unlocked filing cabinet in the lobby — definitely a finding. Still, RoE decides how much you flip through and what you copy. Least impact beats souvenir hunting.
Full Explanation
Anonymous FTP listing on a civic application during approved testing should be recognized as a misconfiguration finding while still following rules of engagement and least-impact data handling. Public redistribution of all listed files is not justified merely because listing was anonymous. Legacy protocols still belong in modern reports when they expose municipal data. Anonymous listings must not become a pretext to attack out-of-scope partner agencies. Exam caveat: if sensitive files appear, follow RoE data-handling and critical-notification rules immediately. Operational check: capture directory listing evidence with minimal file retrieval needed for proof, classify sensitivity, stop further downloads if resident data appears, and recommend disabling anonymous access or retiring FTP for the civic application. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services.