Microsoft Internet Information Server IIS Security & Authentication 2 — Questions and Answers
Question 1: What does enabling HSTS (HTTP Strict Transport Security) on an IIS site do?
- Forces browsers to use HTTPS for all future connections to the site (Correct answer)
- Encrypts the server's private key
- Automatically renews SSL certificates
- Blocks all HTTP methods except GET
Correct answer: Forces browsers to use HTTPS for all future connections to the site
HSTS sends a response header telling browsers to always use HTTPS, preventing downgrade attacks for the specified max-age.
Question 2: Which IIS module provides rule-based URL rewriting, including enforcing HTTPS redirects?
- URL Rewrite Module (Correct answer)
- ARR (Application Request Routing)
- HTTP Redirect
- Rewrite Cache
Correct answer: URL Rewrite Module
The URL Rewrite Module allows pattern-based rules to redirect HTTP to HTTPS and many other URL transformations.
Question 3: What is the purpose of the IIS IUSR account?
- It is the default anonymous user account for unauthenticated web requests (Correct answer)
- It manages IIS service startup
- It is used for Windows Authentication
- It owns the applicationHost.config file
Correct answer: It is the default anonymous user account for unauthenticated web requests
IUSR is the built-in anonymous user IIS impersonates when serving requests that do not require authentication.
Question 4: Which IIS security feature dynamically detects and blocks IP addresses that send too many requests?
- Dynamic IP Restrictions (Correct answer)
- IP Address and Domain Restrictions
- Request Filtering
- Request Monitor
Correct answer: Dynamic IP Restrictions
Dynamic IP Restrictions automatically denies IPs that exceed a configured request rate, helping mitigate DoS attacks.
Question 5: Where is an SSL/TLS certificate bound to an IIS website configured?
- In the site Bindings dialog under HTTPS port 443 (Correct answer)
- In the application pool advanced settings
- In applicationHost.config directly only
- In the Windows certificate store only, not in IIS Manager
Correct answer: In the site Bindings dialog under HTTPS port 443
You bind an SSL certificate to a site by editing its Bindings in IIS Manager, selecting HTTPS, port 443, and the certificate.
Question 6: What does the 'Require SSL' setting in IIS do when enabled for a site or application?
- Returns a 403.4 error for any request that does not use HTTPS (Correct answer)
- Automatically upgrades HTTP connections to HTTPS
- Blocks all external users
- Forces mutual TLS client certificate authentication
Correct answer: Returns a 403.4 error for any request that does not use HTTPS
When Require SSL is enabled, IIS rejects plain HTTP requests with a 403.4 Forbidden – SSL required error.
Microsoft Internet Information Server IIS Security & Authentication 2
What does enabling HSTS (HTTP Strict Transport Security) on an IIS site do?