Microsoft Internet Information Server IIS Security & Authentication

Question 1

Which IIS authentication method sends credentials as a base64-encoded string that can easily be decoded?

Accepted Answer

Basic Authentication

Answer

Basic Authentication encodes credentials in base64, which provides no real encryption and should only be used over HTTPS.

Question 2

What is the primary advantage of Windows Authentication in IIS for intranet environments?

Accepted Answer

Users are authenticated via their Active Directory credentials without entering a password again

Answer

Windows Authentication uses Kerberos or NTLM to perform single sign-on using the user's existing domain login.

Question 3

Which IIS feature allows you to block requests from specific IP addresses or ranges?

Accepted Answer

IP Address and Domain Restrictions

Answer

The IP Address and Domain Restrictions feature in IIS lets you allow or deny access based on client IP addresses.

Question 4

What SSL/TLS binding type in IIS 8+ allows multiple SSL certificates on one IP address using SNI?

Accepted Answer

SNI (Server Name Indication)

Answer

SNI bindings let IIS serve different SSL certificates on the same IP and port by reading the hostname in the TLS handshake.

Question 5

Which IIS feature limits the types of file extensions and HTTP verbs that can be requested?

Accepted Answer

Request Filtering

Answer

Request Filtering can block double-encoded requests, dangerous file extensions, HTTP verbs, and oversized requests.

Microsoft Internet Information Server Practice Test