What is the 'principle of least privilege' in web server configuration, and how does it apply to the web server process?

• A.Least privilege: the web server process should run as a dedicated non-root user with read-only access to web files and no access to files outside the web root. Example: Nginx worker processes run as 'www-data' (limited user), while only the master process (which binds to port 80/443) runs as root - then drops privileges to the worker user
• B.Least privilege means the web server should have access to all files to efficiently serve requests
• C.Web servers must run as root to bind to ports 80 and 443 throughout their lifetime; chroot jails virtualize the network stack, giving each jailed process its own firewall rules; SIGHUP on any web server process clears the OS page cache, forcing the next request to disk; ulimit file descriptor caps apply per virtual host, letting one busy vhost exhaust another's connections; Apache prefork spawns one process per TLS certificate, which is why SAN certificates reduce memory usage
• D.Least privilege only applies to database connections, not web server processes