A vulnerability analyst conducts a web application scan on an asset sitting behind a load...

The ZAP finding concerns information disclosure through the HTTP Server response header , so the correct remediation is to suppress or minimize that header while leaving the website operational. OWASP ZAP maintains specific alerts for servers that disclose the web-server application or version through this response field. The version-disclosure rule is categorized as information exposure because detailed server identification can assist reconnaissance and vulnerability targeting.

Removing unnecessary product and version information reduces information available to an attacker without interrupting legitimate HTTP requests. This directly satisfies the requirement to remediate the finding while maintaining service availability.

Geo-blocking does not correct server-version disclosure and may unnecessarily deny legitimate users based on location. OCSP stapling relates to certificate-revocation status in TLS and is irrelevant to an HTTP server-header disclosure. Blocking incoming HTTP entirely would make the current endpoint unavailable, contradicting the requirement to keep the site operational.

The remediation principle is therefore minimize externally exposed implementation details while preserving application functionality . Server banners are not themselves an exploit, but they can improve an attacker's ability to fingerprint technology and select applicable exploits.

Study Guide Reference: Vulnerability Management → Web Application Scanning → OWASP ZAP → Information Disclosure → HTTP Server Headers → Banner Suppression → Secure Configuration.