312-50 Question 292
Single answer▪ Web Server Attack CountermeasuresA company hosts a public-facing Apache web server on Linux for its customer portal. During a security assessment, you discover that the server reveals its exact Apache version in HTTP response headers, directory listing is enabled on an uploads folder, several sample files are still present from the default installation, and the security team wants to reduce the server's exposure without affecting the application logic. Which countermeasure is the MOST appropriate to implement first to directly reduce web server information leakage and unnecessary attack surface?
- A
Harden the Apache configuration by disabling server version banners, removing default/sample content, and turning off directory listing for unnecessary paths
- B
Move the web application to a different TCP port so automated scanners are less likely to find it
- C
Enable IP forwarding on the Linux host so reverse proxies can better filter malicious requests
- D
Increase the Apache timeout values so the server can better handle malformed requests under load
Show answer and explanation
Correct answer: A
Explanation
The best answer is to harden the Apache configuration and remove unnecessary content because the scenario is about web server attack countermeasures focused on reducing exposure without modifying the application itself. Practical hardening steps include minimizing server-identifying headers, disabling directory indexing unless explicitly required, and removing default/sample files and documentation left after installation. These steps reduce reconnaissance value for attackers and eliminate unnecessary resources that may contain vulnerabilities or sensitive information. This aligns with common guidance from Apache HTTP Server documentation and web server hardening best practices, including use of ServerTokens, ServerSignature, and directory-level Options settings. By contrast, moving services to a different port is not a primary security control, IP forwarding is unrelated to the problem, and increasing timeouts does not address the identified findings.
- A. Correct.
Correct. This option directly addresses the specific weaknesses identified in the scenario: version disclosure, enabled directory indexing, and leftover default/sample content. In Apache, administrators commonly reduce information leakage by setting directives such as ServerTokens to a minimal value and ServerSignature Off, disable directory listing with Options -Indexes where appropriate, and remove default files, manuals, and sample applications that increase attack surface. These are standard web server hardening measures that do not require changing application logic.
- B. Incorrect.
Incorrect. Changing the listening port may reduce noise from simplistic scans, but it is security through obscurity and does not fix the actual misconfigurations. Attackers and scanners can still discover nonstandard ports. The server would continue leaking version information, exposing directory contents, and retaining unnecessary sample files.
- C. Incorrect.
Incorrect. IP forwarding is a network-layer function used when a host routes traffic between interfaces. It is not a web server hardening control for Apache information leakage or attack surface reduction. In many cases, enabling IP forwarding unnecessarily could expand system functionality rather than reduce exposure.
- D. Incorrect.
Incorrect. Increasing timeout values does not mitigate banner disclosure, directory listing, or default content exposure. In some environments, overly long timeouts can even worsen resource exhaustion risks by keeping connections open longer. This option does not address the root causes identified in the assessment.