LPIC-2 Disable directory listing Practice Question
Which TWO are best practices for securing an Apache web server?
⚠ Common exam trap
Candidates often mistakenly think that enabling mod_info is a secure monitoring method or that ServerTokens Prod is unnecessary. However, the trap is that ServerTokens Prod is a minimal disclosure setting, while mod_info exposes sensitive configuration details unless tightly access-controlled. Also, using .htaccess for all access control (option C) is not a best practice because it reduces performance and is unnecessary when main config changes are possible.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable directory listing using Options -Indexes.
Disabling directory listing with `Options -Indexes` prevents Apache from generating a list of files in a directory when no index file (e.g., index.html) is present. This is a fundamental security hardening step that avoids exposing the directory structure, which could reveal sensitive files or paths to attackers. Option D is also correct: setting `ServerTokens Prod` reduces the amount of information Apache reveals about itself in HTTP headers and error pages (e.g., it omits the version number and OS details), making it harder for attackers to target specific vulnerabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Allow directory indexing for ease of navigation.
Why it's wrong here
Directory indexing is a security risk and should be disabled.
- ✓
Disable directory listing using Options -Indexes.
Why this is correct
Prevents directory browsing, reducing information leakage.
- ✗
Use .htaccess files for all access control.
Why it's wrong here
Overuse of .htaccess can cause performance issues and is less secure than main config.
- ✓
Set ServerTokens to Prod to minimize version exposure.
Why this is correct
Reduces information available to potential attackers.
- ✗
Enable mod_info to monitor server status.
Why it's wrong here
mod_info exposes detailed server configuration, which is a security risk.
Go deeper
Related to this question
About these practice questions
This LPIC-2 question is part of Courseiva's 507-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.