CyberCertPrepWeb App FundamentalsWeb Servers & DeploymentEASYFree question
A web server is configured to display a Server header that reveals 'Apache/2.4.29 (Ubuntu)'. Why might a security-conscious administrator want to suppress or change this?
- A.It reveals the software type and exact version, helping attackers quickly identify known CVEs for that specific version
- B.The Server header increases response size significantly
- C.The Server header conflicts with CORS headers
- D.Regulatory compliance forbids disclosing server software names
Why A is correct
Server version disclosure (information leakage) lets attackers look up exact CVEs for Apache 2.4.29. While 'security through obscurity' alone is not sufficient, reducing unnecessary information disclosure is a basic hardening step (ServerTokens Prod in Apache, server_tokens off in Nginx).
Know someone studying for Web App Fundamentals? Send them this one.