Exam objective
CEHHacking Web Servers
This objective sits in Web Application Hacking, which carries 14% of the CEH exam. The questions below are original, written from the official objective title above, and each explanation cites the EC-Council page it rests on.
Objective title verbatim from the official objectives. EC-Council exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A tester reports that the site's responses advertise the exact Apache release, the operating system family and every compiled-in module. Which setting trims that disclosure the most?
Correct.
Checked against httpd.apache.org, September 2026Concept
A web server's response headers are an inventory of the software behind them. Reducing what the product identity line reveals removes free reconnaissance work without changing how requests are answered.
Why A
Prod sends only the product name, so the release number, the platform and the module list stop appearing in the Server header field that every client receives.
Source
Apache Software Foundation, core, ServerTokens Directive, checked September 2026ServerTokens Full (or not specified) Server sends ( e.g. ): Server: Apache/2.4.2 (Unix) PHP/4.2.2 MyMod/1.2 ServerTokens Prod[uctOnly] Server sends ( e.g. ): Server: Apache…
Now you: practice questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
During a hardening review an administrator is told to stop the server answering TRACE requests outright. Which directive value makes Apache refuse them with 405?
Sample question 2 of 3
An engineer moves a site behind nginx and must stop the version string appearing on error pages and in responses. Which directive setting does that?
Sample question 3 of 3
An engineer finds browsable file listings under a static path on nginx where the index file is missing. Which directive controls whether that listing is produced?
That’s 3 of the full CEH bank.
Keep going free: 10 questions per certification in bank practice, with no account.
Continue practicingRead the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.