CyberCertPrepWeb App FundamentalsWeb Servers & DeploymentEASYFree question
A web server is configured to display a Server header that reveals 'Apache/2.4.29 (Ubuntu)'. Why might a security-conscious administrator want to suppress or change this?
- A.It reveals the software type and exact version, helping attackers quickly identify known CVEs for that specific version
- B.It reveals the operating system and kernel build, helping attackers match local privilege escalation exploits
- C.It leaks the document root and the virtual host list, giving attackers a map of the server's hosted sites
- D.It exposes the worker process count and thread model, letting attackers size a denial-of-service attack
Why A is correct
Server version disclosure (information leakage) lets attackers look up exact CVEs for Apache 2.4.29. While 'security through obscurity' alone is not sufficient, reducing unnecessary information disclosure is a basic hardening step (ServerTokens Prod in Apache, server_tokens off in Nginx).
Know someone studying for Web App Fundamentals? Send them this one.