This is why I always attempt to turn off as much version information output as possible from any service. Make the pentester do their homework and not just look at "Apache 2.XX"
Hopefully you also have an internal control that looks at actual package versions installed on the server.
Hopefully you also have an internal control that looks at actual package versions installed on the server.