A library site hides admin paths, so content discovery is planned. What is the proper purpose of that activity?
Select an answer to reveal the explanation.
Short Explanation
Hidden admin doors still count if they are on the property you were hired to inspect. Controlled content discovery looks for those unlinked paths and APIs. Keep the rate civilized — knocking over the site is not the goal.
Full Explanation
Content discovery on a library site exists to find unlinked admin or API surfaces in a controlled way within rules of engagement—not to deny service. Unbounded high-rate discovery that takes the site down proves the wrong point and violates availability protections. Hidden paths on public sites can absolutely be in scope for web testing when RoE allows discovery. Limiting work to homepage spelling checks skips directories and endpoints that often hold privileged functions. Exam caveat: wordlists and concurrency must match RoE caps; pause if 429/gateway errors indicate stress. Operational check: run throttled discovery against approved hosts, review interesting paths manually, avoid destructive methods, and document newly found admin/API surfaces for the library security contact. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services.