I have just been working with one of our faculty who uploaded exam question (into files), on a pdf file, and imediately secured it to "only available to students with a link." He was going to link it within the exam, but by the time he restricted it to the "link only" setting they all had the link because they all got notified when he uploaded it. He had to add a time/date limit onto that security setting before he successfully kept them out, which he did not discover until a student contacted him and they tested it.
So, upon hearing from him, I did some testing as well: linking the file within the first question of an exam, locking the exam until a later date, and unpublishing the exam--in all cases, that file was ready and available to students, no problem. Even if "files" was hidden, the link still worked. Now, as Kona points out above, if "files" was hidden from student view, the file was uploaded into an unpublished quiz or module, it would've likely been inaccessible (since there isn't a link involved), but this seems problematic. Everything else in the course requires publishing. Why not files?
This discussion post is outdated and has been archived. Please use the Community question forums and official documentation for the most current and accurate information.