A web server configuration audit finds 'ServerSignature On' and 'ServerTokens Full' in Apache httpd.conf. What information is exposed and what should these be changed to?

• A.These directives control HTTP/2 support and should be set to 'HTTP2'
• B.ServerSignature On adds the Apache version and OS to error pages; ServerTokens Full includes the full server version, OS, and loaded modules in the Server response header. Both aid attacker fingerprinting for CVE targeting. Change to 'ServerSignature Off' and 'ServerTokens Prod' (which only reveals 'Apache' without version) to minimize information disclosure
• C.These directives only affect logging, not response headers
• D.ServerTokens Full is required for browser compatibility testing