Web logs for the municipal document portal show requests with sequences like ../ and paths resembling /etc/passwd under the application URL. Which application attack indicator is this?

Directory traversal (path traversal) manipulates URL or input paths—often with ../ sequences—to escape the web application’s intended directory and read sensitive files outside the web root. Requests resembling /etc/passwd under the municipal document portal URL are classic traversal indicators aimed at confidentiality of OS or application files. Public document portals for permits and records are frequent targets because they accept path-like parameters for downloads.

Amplified DDoS using reflected DNS responses is a volumetric availability attack with oversized replies, not ../ path probes in application logs. Password spraying with one password across many clerks is an authentication pattern in identity logs, unrelated to web path escape. RFID cloning of badges used for building access is physical credential theft, not an HTTP traversal indicator.

Exam caveat: traversal is an application attack against path handling; distinguish it from remote code execution or SQLi when the stem only shows path sequences and sensitive file targets. Encoding variants (%2e%2e%2f) still count as traversal indicators on exams.

Operational check: patch or reconfigure the portal to canonicalize and jail document roots, block ../ patterns at WAF or application middleware, review access logs for successful reads of sensitive paths, rotate any credentials that might have been exposed in retrieved files, and retest after fixes with authorized municipal security tooling.