A security engineer reviews an Apache web server configuration and finds 'Options +Indexes' in the .htaccess file. What is this setting and what is the recommended change?

• A.Options +Indexes turns on symbolic link following: if a directory contains a symlink (ln -s), Apache will follow it to files outside the document root, and a request for the link name exposes /etc contents. Change to 'Options -FollowSymLinks' to return 403 Forbidden for linked paths in the .htaccess file of each directory, a setting that Apache re-reads from the same file on each request when AllowOverride permits it for the directory
• B.Options +Indexes enables server-side includes: if a page contains an SSI directive (<!--#exec cmd-->), Apache will run the command and print its output into the response. This lets an attacker execute system commands from uploaded HTML files, a risk for upload directories. Change to 'Options -Includes' and remove the AddHandler line for .shtml pages from the server configuration
• C.Options +Indexes enables content negotiation: if a request has no file extension (page instead of page.html), Apache will pick a variant from the directory and return it with a 300 Multiple Choices response. This can confuse caches and break clients that expect a fixed URL. Change to 'Options -MultiViews' to return a single 404 Not Found for extensionless requests