A web server configuration audit finds 'ServerSignature On' and 'ServerTokens Full' in Apache httpd.conf. What information is exposed and what should these be changed to?

• A.ServerSignature On adds a footer with the Apache version and the admin email to all error pages; ServerTokens Full exposes the OS, loaded modules, and the PHP build in the Server header (the same data nmap reads from banners), so attackers can match CVEs. Change them to 'ServerSignature EMail' and 'ServerTokens Minor', which limit the header to the major.minor release number, a setting that still lets scanners narrow the candidate CVE list
• B.ServerSignature On prints the Apache version in the TLS certificate subject; ServerTokens Full publishes the document root path and file owner in the Server header (a path disclosure), so the fix is to set both to 'Off', which Apache accepts for each directive on all releases
• C.ServerSignature On prints the Apache build date and the virtual host name on directory listings; ServerTokens Full adds the kernel version to the Server header (a leak of uname output), so both should be set to 'Prod', which Apache accepts for each directive on every release