Microsoft Internet Information Server IIS Security & Authentication 2

Question 1

What does enabling HSTS (HTTP Strict Transport Security) on an IIS site do?

Accepted Answer

Forces browsers to use HTTPS for all future connections to the site

Answer

HSTS sends a response header telling browsers to always use HTTPS, preventing downgrade attacks for the specified max-age.

Question 2

Which IIS module provides rule-based URL rewriting, including enforcing HTTPS redirects?

Accepted Answer

URL Rewrite Module

Answer

The URL Rewrite Module allows pattern-based rules to redirect HTTP to HTTPS and many other URL transformations.

Question 3

What is the purpose of the IIS IUSR account?

Accepted Answer

It is the default anonymous user account for unauthenticated web requests

Answer

IUSR is the built-in anonymous user IIS impersonates when serving requests that do not require authentication.

Question 4

Which IIS security feature dynamically detects and blocks IP addresses that send too many requests?

Accepted Answer

Dynamic IP Restrictions

Answer

Dynamic IP Restrictions automatically denies IPs that exceed a configured request rate, helping mitigate DoS attacks.

Question 5

Where is an SSL/TLS certificate bound to an IIS website configured?

Accepted Answer

In the site Bindings dialog under HTTPS port 443

Answer

You bind an SSL certificate to a site by editing its Bindings in IIS Manager, selecting HTTPS, port 443, and the certificate.

Microsoft Internet Information Server Practice Test