312-50 Question 293
Single answer▪ Web Server Attack CountermeasuresA company hosts a public-facing Linux web server running Apache HTTP Server for its customer portal. During a security assessment, you discover that the server discloses its exact Apache version in HTTP response headers, directory listing is enabled in several upload folders, and administrative interfaces are reachable from the Internet. The portal must remain public, but the security team wants to reduce the web server's attack surface with minimal impact on application functionality. Which countermeasure should be implemented FIRST to address the most direct web server hardening gaps identified?
- A
Disable unnecessary modules and features, turn off directory listing, suppress detailed server banners, and restrict access to administrative interfaces by IP or network ACLs
- B
Install a new TLS certificate and force HTTPS for all users, because encryption prevents version disclosure and blocks access to administrative paths
- C
Move the web application to a different TCP port, because attackers primarily target web servers running on ports 80 and 443
- D
Increase the Apache timeout values and keep-alive settings, because longer sessions make reconnaissance and enumeration less reliable
Show answer and explanation
Correct answer: A
Explanation
The most appropriate first step is to implement core web server hardening controls that directly remediate the discovered exposures. In Apache, this commonly includes disabling unused modules, disabling directory indexing (for example, removing or overriding the Indexes option), limiting version/banner disclosure through settings such as ServerTokens and ServerSignature, and restricting sensitive paths or admin panels using host-based access controls, reverse proxy rules, firewall policy, or VPN-only access. These actions reduce information leakage and externally reachable functionality without requiring major application redesign. HTTPS is still important and should be used, but it does not replace server hardening. This aligns with common guidance from Apache HTTP Server security documentation and general best practices such as minimizing attack surface, reducing unnecessary service exposure, and enforcing administrative access restrictions.
- A. Correct.
Correct. This option directly addresses the specific weaknesses found during the assessment using standard web server hardening measures. Disabling unnecessary modules reduces attack surface, turning off directory indexing prevents attackers from browsing exposed file locations, suppressing detailed server banners limits passive fingerprinting, and restricting administrative interfaces to trusted IP ranges prevents unnecessary Internet exposure. These are classic Apache hardening steps aligned with least functionality and least exposure principles.
- B. Incorrect.
Incorrect. Enforcing HTTPS is a good security practice for protecting data in transit, session cookies, and credentials, but it does not by itself stop server version disclosure if headers are still configured to reveal them, nor does it restrict Internet access to administrative interfaces. TLS improves confidentiality and integrity, but it is not the primary fix for the web server hardening gaps described.
- C. Incorrect.
Incorrect. Security through obscurity by changing the listening port does not meaningfully reduce attack surface. Port scanning easily identifies services on nonstandard ports, and the underlying issues such as directory listing, server banner disclosure, and exposed admin interfaces would still remain. This is a common misconception when trying to harden Internet-facing services.
- D. Incorrect.
Incorrect. Increasing timeout or keep-alive values is generally a performance or connection-handling adjustment, not a countermeasure for the identified findings. In some cases, poorly chosen timeout settings can even increase resource consumption and make denial-of-service conditions worse. It does nothing to prevent enumeration, banner grabbing, or unauthorized access to admin interfaces.