What is the 'principle of least privilege' in web server configuration, and how does it apply to the web server process?

• A.Least privilege means the web server should have access to all files to efficiently serve requests
• B.Web servers must run as root to bind to ports 80 and 443 throughout their lifetime
• C.Least privilege only applies to database connections, not web server processes
• D.Least privilege: the web server process should run as a dedicated non-root user with read-only access to web files and no access to files outside the web root. Example: Nginx worker processes run as 'www-data' (limited user), while only the master process (which binds to port 80/443) runs as root - then drops privileges to the worker user