You can't really tell by the version number. For example Debian stable has Apache 2.2.22 but with security patches back-ported from Apache 2.2.29. It is quite common to stay a a certain well-tested version for a while and only fix security issues.
If they are running the latest version from the distro vendor, and the distro vendor has maintained the software, the version should be fine. Most major Linux distributions distribute the same version of a package throughout a life cycle (i.e. CentOS 6 will have the same version of Apache for its entire 5+ years of maintained life), with backported security fixes and occasional bugfixes. That is not a bug, it's a feature.
I'm not saying the Apache isn't exploitable, but you need to know more than the Apache version. You'd need to know the distro package version information, and compare it to the latest package available from the distro installed on the server.