Yes, you should put all the files you don't want indexed in a robots.txt file.
If it's a secret file, password protect it!