PCI Approved Scanning Vendor (ASV) Online Practice Test

Directory browsing is an information disclosure risk that happens when a web server reveals the list of files in a directory to a client. This is especially dangerous on web servers because it exposes the site’s internal structure, backup copies, configuration files, and other sensitive data that an attacker could use to plan targeted attacks or discover vulnerabilities. In PCI scans, preventing this disclosure is a basic hardening step for any publicly accessible web content.

That’s why the web server is the component where directory browsing should be disabled. Other components like mail servers, application servers, or DNS servers don’t typically expose a directory listing over the web in the same direct way, so the immediate risk from directory listing isn’t the same for them. The remedy is to configure the web server to turn off directory indexing (for example, disabling autoindex/Indexes in Apache, turning off Directory Browsing in IIS, or disabling autoindex in Nginx) and ensure an appropriate default index file is served.