Alice, a security engineer, was performing security testing on the application.

To mitigate the security risk of users being able to view the website structure and file names, the correct action would be to disable directory listings. This is often accomplished through configuration settings in web server software, where you can specify whether to allow or deny the listing of directory contents. The option <int-param> <param-name>listings <param-value>false</int-param> effectively disables directory listings, preventing users and potential attackers from viewing the website's file and directory structure, thus enhancing security. Ensuring that directory listings are disabled is a common security practice to avoid revealing sensitive information about the web application's structure.References:

Web Server Security Best Practices documentation

OWASP (Open Web Application Security Project) guidelines on securing web server configurations