CyberCertPrepWeb App FundamentalsWeb Servers & DeploymentEASYFree question
An Apache server returns the error page: 'Apache/2.4.50 (Unix) mod_ssl/2.4.50 OpenSSL/1.1.1l PHP/7.4.21 Server at example.com Port 80'. What should be done and why?
- A.Nothing; version disclosure is required for debugging
- B.Configure ServerTokens Prod and ServerSignature Off to hide version details; knowing exact versions allows attackers to look up specific CVEs for Apache 2.4.50, OpenSSL 1.1.1l, and PHP 7.4.21 - each of which may have known vulnerabilities
- C.Upgrade the server to remove the version from the response
- D.This is only a risk if the server is running vulnerable versions
Why B is correct
Apache 2.4.50 is specifically notable - it was vulnerable to path traversal CVE-2021-41773 and CVE-2021-42013. Exposing exact versions gives attackers a direct exploit map. 'ServerTokens Prod' shows only 'Apache', and 'ServerSignature Off' removes the footer. Reducing exposed information is basic hardening (security through obscurity is not sufficient alone, but information minimization is always good practice).
Know someone studying for Web App Fundamentals? Send them this one.