A web server configuration audit finds 'ServerSignature On' and 'ServerTokens Full' in Apache httpd.conf. What information is exposed and what should these be changed to?

• A.These directives only affect logging, not response headers; nginx passes the client's original IP to upstreams automatically, with X-Forwarded-For only mattering for Apache; Apache's .htaccess files are compiled into the server binary at build time, and changing one requires recompiling httpd; Apache prefork spawns one process per TLS certificate, which is why SAN certificates reduce memory usage; X-Forwarded-For is trustworthy end to end because each proxy cryptographically signs the value it appends
• B.These directives control HTTP/2 support and should be set to 'HTTP2'
• C.ServerTokens Full is required for browser compatibility testing
• D.ServerSignature On adds the Apache version and OS to error pages; ServerTokens Full includes the full server version, OS, and loaded modules in the Server response header. Both aid attacker fingerprinting for CVE targeting. Change to 'ServerSignature Off' and 'ServerTokens Prod' (which only reveals 'Apache' without version) to minimize information disclosure