Microsoft Internet Information Server IIS Security & Authentication 1 — Questions and Answers
Question 1: Which IIS authentication method sends credentials as a base64-encoded string that can easily be decoded?
- Basic Authentication (Correct answer)
- Windows Authentication
- Digest Authentication
- Forms Authentication
Correct answer: Basic Authentication
Basic Authentication encodes credentials in base64, which provides no real encryption and should only be used over HTTPS.
Question 2: What is the primary advantage of Windows Authentication in IIS for intranet environments?
- Users are authenticated via their Active Directory credentials without entering a password again (Correct answer)
- It supports all browsers equally including mobile
- It encrypts traffic automatically without SSL
- It works across all internet-facing websites
Correct answer: Users are authenticated via their Active Directory credentials without entering a password again
Windows Authentication uses Kerberos or NTLM to perform single sign-on using the user's existing domain login.
Question 3: Which IIS feature allows you to block requests from specific IP addresses or ranges?
- IP Address and Domain Restrictions (Correct answer)
- Request Filtering
- URL Authorization
- Dynamic IP Restrictions
Correct answer: IP Address and Domain Restrictions
The IP Address and Domain Restrictions feature in IIS lets you allow or deny access based on client IP addresses.
Question 4: What SSL/TLS binding type in IIS 8+ allows multiple SSL certificates on one IP address using SNI?
- SNI (Server Name Indication) (Correct answer)
- Wildcard binding
- IP-based SSL
- SAN certificate binding
Correct answer: SNI (Server Name Indication)
SNI bindings let IIS serve different SSL certificates on the same IP and port by reading the hostname in the TLS handshake.
Question 5: Which IIS feature limits the types of file extensions and HTTP verbs that can be requested?
- Request Filtering (Correct answer)
- Output Caching
- MIME Types
- Compression
Correct answer: Request Filtering
Request Filtering can block double-encoded requests, dangerous file extensions, HTTP verbs, and oversized requests.
Question 6: What is the default identity under which IIS application pool worker processes run?
- ApplicationPoolIdentity (Correct answer)
- NETWORK SERVICE
- LOCAL SYSTEM
- IUSR
Correct answer: ApplicationPoolIdentity
Since IIS 7.5, application pools default to the ApplicationPoolIdentity, a least-privilege virtual account unique to each pool.
Microsoft Internet Information Server IIS Security & Authentication 1
Which IIS authentication method sends credentials as a base64-encoded string that can easily be decoded?