Implementing and Supporting Microsoft Internet Information Server (IIS) — Questions and Answers

Question 1: What happens to queued requests when an IIS application pool recycles?

All requests pause until the new worker process is fully started
All queued requests are immediately dropped with a 503 error
IIS returns a 302 redirect to clients during recycle
The old worker process finishes serving active requests while the new one handles incoming requests (overlapped recycle) (Correct answer)

Correct answer: The old worker process finishes serving active requests while the new one handles incoming requests (overlapped recycle)

By default, IIS performs an overlapped recycle where the old w3wp.exe handles existing requests while a new one starts for incoming ones.

Question 2: Which IIS security feature dynamically detects and blocks IP addresses that send too many requests?

Request Monitor
IP Address and Domain Restrictions
Dynamic IP Restrictions (Correct answer)
Request Filtering

Correct answer: Dynamic IP Restrictions

Dynamic IP Restrictions automatically denies IPs that exceed a configured request rate, helping mitigate DoS attacks.

Question 3: How should Microsoft Internet Information Server professionals apply research findings to practice?

Critically evaluate applicability, adapt to context, and monitor outcomes (Correct answer)
Implement immediately without evaluation
Ignore research that contradicts experience
Only follow systematic reviews

Correct answer: Critically evaluate applicability, adapt to context, and monitor outcomes

This is fundamental to Microsoft Internet Information Server practice. Critically evaluate applicability, adapt to context, and monitor outcomes represents the professional standard for research in the Microsoft Internet Information Server certification framework.

Question 4: Which IIS feature can automatically compress static files and cache the compressed versions to reduce bandwidth usage?

Output Caching
Dynamic Content Compression
Static Content Compression (Correct answer)
Kernel-mode Caching

Correct answer: Static Content Compression

Static Content Compression compresses files like HTML, CSS, and JS and can cache results, while Dynamic Content Compression handles runtime responses.

Question 5: Which application pool recycling trigger causes the worker process to restart based on memory consumption?

Idle timeout
Virtual memory limit (Correct answer)
Connection timeout
Request queue limit

Correct answer: Virtual memory limit

The virtual memory limit setting causes IIS to recycle the worker process when it exceeds a specified amount of virtual memory allocation.

Question 6: What action does IIS take when an application pool's idle timeout period expires?

The worker process is shut down to free server resources (Correct answer)
The worker process is recycled and restarted immediately
The application pool is suspended but its configuration is preserved in memory
The application pool is permanently deleted from IIS configuration

Correct answer: The worker process is shut down to free server resources

When idle timeout is reached with no incoming requests, IIS shuts down the worker process to conserve server resources until a new request triggers a restart.

Question 7: What is the purpose of the IIS IUSR account?

It owns the applicationHost.config file
It is used for Windows Authentication
It is the default anonymous user account for unauthenticated web requests (Correct answer)
It manages IIS service startup

Correct answer: It is the default anonymous user account for unauthenticated web requests

IUSR is the built-in anonymous user IIS impersonates when serving requests that do not require authentication.

Question 8: What does setting 'validateIntegratedModeConfiguration=false' in web.config allow?

Allows unauthenticated access to all resources
Disables SSL certificate validation
Enables cross-site request forgery protection
Suppresses errors when ASP.NET modules incompatible with Integrated pipeline mode are loaded (Correct answer)

Correct answer: Suppresses errors when ASP.NET modules incompatible with Integrated pipeline mode are loaded

This setting lets older ASP.NET HttpModules run in IIS Integrated mode without throwing configuration validation errors.

Question 9: What is the recommended practice for the IIS service account when connecting to SQL Server from a web application?

Use the SA account for simplicity
Use a dedicated least-privilege service account with only the necessary database permissions (Correct answer)
Use the LOCAL SYSTEM account
Use Anonymous Authentication mapped to a SQL login

Correct answer: Use a dedicated least-privilege service account with only the necessary database permissions

A dedicated service account with minimal SQL permissions follows the principle of least privilege and reduces breach impact.

Question 10: When an IIS application pool is configured in 'Classic' pipeline mode, how are ASP.NET requests processed?

Requests are routed through the ASP.NET ISAPI extension (aspnet_isapi.dll) (Correct answer)
ASP.NET content is processed by a dedicated separate worker process instance
Requests are handled exclusively by the IIS kernel-mode HTTP driver (http.sys)
The IIS native pipeline processes all ASP.NET requests directly without ISAPI

Correct answer: Requests are routed through the ASP.NET ISAPI extension (aspnet_isapi.dll)

In Classic mode, ASP.NET requests pass through the aspnet_isapi.dll ISAPI extension, which is the same processing model used in IIS 6 and earlier versions.

Question 11: What is the primary advantage of Windows Authentication in IIS for intranet environments?

It supports all browsers equally including mobile
It encrypts traffic automatically without SSL
It works across all internet-facing websites
Users are authenticated via their Active Directory credentials without entering a password again (Correct answer)

Correct answer: Users are authenticated via their Active Directory credentials without entering a password again

Windows Authentication uses Kerberos or NTLM to perform single sign-on using the user's existing domain login.

Question 12: A SaaS company uses IIS ARR as a reverse proxy for multiple backend APIs. They need to route requests to different backends based on the URL prefix (/api/v1 vs /api/v2). What ARR feature enables this?

URL Rewrite rules combined with ARR server farms using route-to-server-farm actions (Correct answer)
Server Farm health check rules
HTTP Redirect rules in each site's bindings
ARR's load balancing algorithm set to URL hash

Correct answer: URL Rewrite rules combined with ARR server farms using route-to-server-farm actions

URL Rewrite rules inspect the URL prefix and route matching requests to the appropriate ARR server farm, enabling path-based routing to different backend clusters.

Question 13: Which Windows event log should administrators check when an IIS application pool fails to start?

System Log
Setup Log
Application Log (Correct answer)
Security Log

Correct answer: Application Log

Application pool startup failures and worker process errors are recorded in the Windows Application Event Log, typically under the IIS-W3SVC-WP source.

Question 14: A government agency requires that the IIS server only accepts cipher suites approved by NIST. Beyond registry changes, what tool simplifies enforcing approved cipher suite ordering on Windows Server?

IIS Manager SSL Settings dialog
Netsh http commands to set cipher suites
Windows Firewall Advanced Security inbound rules
IIS Crypto (third-party GUI tool) or Group Policy's SSL Cipher Suite Order setting (Correct answer)

Correct answer: IIS Crypto (third-party GUI tool) or Group Policy's SSL Cipher Suite Order setting

Group Policy's SSL Cipher Suite Order under Computer Configuration or tools like IIS Crypto provide a straightforward way to enforce NIST-approved cipher suite ordering on Windows Server.

Question 15: What is the purpose of regular risk reviews in Microsoft Internet Information Server practice?

To generate reports
To satisfy auditors only
To identify new risks, evaluate control effectiveness, and update mitigation strategies (Correct answer)
To reduce workload

Correct answer: To identify new risks, evaluate control effectiveness, and update mitigation strategies

This is fundamental to Microsoft Internet Information Server practice. To identify new risks, evaluate control effectiveness, and update mitigation strategies represents the professional standard for risk management in the Microsoft Internet Information Server certification framework.

Question 16: A network team wants to restrict IIS management traffic to specific IP ranges. Which IIS feature controls IP-based access to the Web Management Service port (8172)?

IIS Manager remote connections allow list
URL Authorization rules
IP Address and Domain Restrictions at the site level
Windows Firewall inbound rule for port 8172 (Correct answer)

Correct answer: Windows Firewall inbound rule for port 8172

A Windows Firewall inbound rule restricting port 8172 to approved source IP ranges is the most reliable way to limit remote IIS Manager access.

Question 17: What does the 'Always Running' startup mode do when configured for an IIS application pool?

Enables continuous load balancing across all configured application pools
Forces the pool's worker process to run at the highest CPU scheduling priority
Prevents the application pool from ever being recycled
Starts the worker process at system startup before any requests arrive (Correct answer)

Correct answer: Starts the worker process at system startup before any requests arrive

'Always Running' pre-warms the application pool by starting the worker process when IIS starts, eliminating cold-start delays on the first incoming request.

Question 18: What risk does enabling HTTP/2 without proper input validation present in IIS?

Loss of URL rewrite rules
Broken certificate chains
Slower page load times
HTTP/2 CONTINUATION frame flooding leading to DoS (Correct answer)

Correct answer: HTTP/2 CONTINUATION frame flooding leading to DoS

HTTP/2 CONTINUATION frame flooding (CVE-2024-27316) can exhaust server memory and cause denial of service if not properly controlled.

Question 19: Which IIS configuration validates that output caching does not serve stale responses by defining the maximum staleness interval for cached content?

Application Pool idle timeout
Output Cache duration and maxAge attributes (Correct answer)
HTTP Keep-Alive timeout
Request Filtering maxUrl attribute

Correct answer: Output Cache duration and maxAge attributes

The Output Cache feature's duration and maxAge settings control how long cached responses are considered fresh before IIS fetches updated content.

Question 20: How should an Microsoft Internet Information Server professional approach a novel situation not covered by standard procedures?

Refuse to proceed
Improvise without documentation
Apply foundational principles, assess risks, consult resources, and document the rationale for decisions (Correct answer)
Follow the closest standard procedure exactly

Correct answer: Apply foundational principles, assess risks, consult resources, and document the rationale for decisions

This is fundamental to Microsoft Internet Information Server practice. Apply foundational principles, assess risks, consult resources, and document the rationale for decisions represents the professional standard for practical in the Microsoft Internet Information Server certification framework.

Question 21: Which authentication scheme in IIS uses a hash of the credentials instead of sending them in clear text?

Digest Authentication (Correct answer)
Anonymous Authentication
Certificate Authentication
Basic Authentication

Correct answer: Digest Authentication

Digest Authentication sends an MD5 hash of the credentials over the network rather than plain text.

Question 22: What IIS feature allows administrators to delegate configuration of specific settings to site owners without granting server-level access?

Delegated Administration via web.config
Feature Delegation (Correct answer)
Shared Configuration
Remote Administration Tool

Correct answer: Feature Delegation

Feature Delegation in IIS Manager lets server administrators control which IIS configuration settings site owners can override in their web.config files.

Question 23: You host a website using Perl scripts for many web pages. You discover that no users can view Web pages that include Perl script. What's the most likely reason?

You need to install Perl interpreter on the Web Server. (Correct answer)
By changing the Scripts folder's properties, you must point to the Perl interpreter installed as part of IIS 4.0.
Perl scripts cannot be used on the Microsoft Web Server. A Microsoft Web server cannot support it.
Each client system has to have the Perl interpreter installed as a plug-in.

Correct answer: You need to install Perl interpreter on the Web Server.

For a web server like IIS to execute scripts written in languages like Perl, the corresponding interpreter for that language must be installed on the server. IIS itself only provides the environment to serve web pages; it relies on external interpreters (like ActivePerl for Perl scripts) to process dynamic content. Without the Perl interpreter installed on the web server, the server cannot understand or run the Perl code, leading to pages not being viewable.

Question 24: When hosting a 32-bit application on a 64-bit IIS server, which application pool setting must be enabled?

Enable Protocol Activation
Enable Kernel-Mode Authentication
Enable 32-Bit Applications (Correct answer)
Enable Preload

Correct answer: Enable 32-Bit Applications

The 'Enable 32-Bit Applications' setting must be set to True so that IIS runs the worker process as a 32-bit process capable of loading 32-bit managed and native assemblies.

Question 25: In IIS 4.0, what permission must a virtual directory have for users to run scripts and executables?

Write
Full Control
Read
Execute (Correct answer)

Correct answer: Execute

The Execute permission allows IIS 4.0 to run ISAPI extensions and CGI programs in a virtual directory.

Question 26: Which IIS configuration section controls the maximum size of an HTTP request body?

system.webServer/security/requestFiltering/requestLimits (Correct answer)
system.webServer/defaultDocument
system.webServer/caching
system.webServer/httpErrors

Correct answer: system.webServer/security/requestFiltering/requestLimits

The maxAllowedContentLength attribute in requestLimits (under requestFiltering) controls the maximum upload body size.

Question 27: Which IIS feature log file setting should be configured to capture client IP addresses when using a reverse proxy?

X-Forwarded-For header logging via W3C custom fields (Correct answer)
Enabling ETW logging
Switching to NCSA log format
Enabling Failed Request Tracing

Correct answer: X-Forwarded-For header logging via W3C custom fields

Adding the X-Forwarded-For header as a custom W3C log field captures the real client IP passed by the proxy.

Question 28: An IIS 10 server hosts 200 sites with unique SSL certificates. The administrator wants to add new sites without obtaining additional IP addresses. What feature makes this possible?

SSL bridging via Application Request Routing
Server Name Indication (SNI) bindings (Correct answer)
Shared SSL certificate with Subject Alternative Names for all 200 domains
Wildcard SSL certificates for all sites

Correct answer: Server Name Indication (SNI) bindings

Server Name Indication (SNI) allows multiple SSL sites to share a single IP address by including the hostname in the TLS handshake, so IIS can select the correct certificate.

Question 29: What does IIS static compression do?

Encrypts static file transfers
Minifies JavaScript and CSS at runtime
Compresses dynamic responses on every request
Compresses static files once and caches the compressed version for subsequent requests (Correct answer)

Correct answer: Compresses static files once and caches the compressed version for subsequent requests

IIS compresses static files (HTML, CSS, JS, images) on the first request and caches the compressed file for future hits.

Question 30: What is the default maximum number of worker processes for a newly created IIS application pool?

1 (Correct answer)
4
8
2

Correct answer: 1

By default, a new IIS application pool is configured with a maximum of 1 worker process; increasing this value creates a Web Garden configuration with multiple workers.

Question 31: Which IIS feature allows administrators to define custom error pages to maintain a consistent user experience when HTTP errors occur?

URL Rewrite rules
HTTP Redirect module
Custom Errors in Error Pages feature (Correct answer)
Request Filtering defaults

Correct answer: Custom Errors in Error Pages feature

The Error Pages feature in IIS Manager lets you configure custom error responses for specific HTTP status codes.

Question 32: Which IIS setting controls how long the server waits for a slow client to send a complete request before closing the connection?

Idle Time-out in application pool settings
Connection Timeout in the site's Limits settings (Correct answer)
Request Queue Timeout
Response Buffering Limit

Correct answer: Connection Timeout in the site's Limits settings

The Connection Timeout in site Limits (default 120 seconds) drops connections from clients that take too long to complete their requests.

Question 33: Which tool introduced in IIS 7 allows administrators to delegate management of specific web features to site owners without granting server-level access?

Web Deployment Agent Service (MSDeploy)
IIS Remote Administration Tool
IIS Manager (with Feature Delegation) (Correct answer)
Windows Admin Center

Correct answer: IIS Manager (with Feature Delegation)

IIS Manager's Feature Delegation allows server administrators to specify which features site owners can configure independently via IIS Manager connected remotely to their site.

Question 34: What is a Virtual Directory in IIS?

A compressed copy of the website content
A URL path that maps to a physical folder outside the site's root (Correct answer)
A directory only accessible via HTTPS
A temporary directory for caching responses

Correct answer: A URL path that maps to a physical folder outside the site's root

A virtual directory maps a URL path to a different physical location on disk or a UNC share.

Question 35: What is the primary value of case study analysis in Microsoft Internet Information Server training?

Memorizing specific outcomes
Developing critical thinking by applying theory to realistic professional scenarios (Correct answer)
Learning only from failures
Replacing hands-on experience

Correct answer: Developing critical thinking by applying theory to realistic professional scenarios

This is fundamental to Microsoft Internet Information Server practice. Developing critical thinking by applying theory to realistic professional scenarios represents the professional standard for practical in the Microsoft Internet Information Server certification framework.

Question 36: Which Windows feature must be enabled for IIS Centralized Certificate Store (CCS) to function?

Windows PKI Auto-Enrollment
Remote Desktop Certificate Templates
Active Directory Certificate Services
Centralized SSL Certificate Support role service in IIS (Correct answer)

Correct answer: Centralized SSL Certificate Support role service in IIS

The Centralized SSL Certificate Support role service must be installed under IIS Security to enable CCS.

Question 37: What key benefit does process isolation provide when using separate IIS application pools?

It prevents a crash or memory leak in one pool from affecting applications in other pools (Correct answer)
It allows URL authorization rules to be applied at the pool level
It enables request filtering to block malicious URLs across all pools
It enables output caching to be shared across multiple application pools

Correct answer: It prevents a crash or memory leak in one pool from affecting applications in other pools

Process isolation ensures each application pool runs in its own worker process so that a crash, memory leak, or runaway thread in one pool cannot destabilize applications in separate pools.

Question 38: Which PowerShell cmdlet from the WebAdministration module is used to recycle an IIS application pool?

Refresh-WebAppPool
Reset-WebAppPool
Recycle-WebAppPool
Restart-WebAppPool (Correct answer)

Correct answer: Restart-WebAppPool

Restart-WebAppPool is the WebAdministration cmdlet that recycles a specified IIS application pool, causing its worker process to shut down and restart.

Question 39: What is the purpose of the IIS 'Failed Request Tracing' feature?

To redirect failed requests to a backup server
To block suspicious requests in real time
To send email alerts when a 500 error occurs
To log detailed diagnostic information for requests that meet failure criteria (Correct answer)

Correct answer: To log detailed diagnostic information for requests that meet failure criteria

Failed Request Tracing captures detailed trace events for requests that fail based on configurable rules, aiding troubleshooting.

Question 40: What is a 'Web Garden' configuration in IIS?

A security zone that isolates trusted web applications from public ones
An application pool configured to use multiple worker processes on a single server (Correct answer)
A virtual directory structure organizing web content by topic
A group of IIS servers in a network load-balanced cluster

Correct answer: An application pool configured to use multiple worker processes on a single server

A Web Garden is an application pool configured with more than one worker process, distributing request load across multiple w3wp.exe instances on a single server.

Question 41: What is the primary role of the w3wp.exe process in IIS?

To manage DNS resolution for incoming web requests
To manage IIS configuration and metabase backups
To handle SSL certificate validation for HTTPS sites
To host and execute web applications within an application pool (Correct answer)

Correct answer: To host and execute web applications within an application pool

w3wp.exe is the IIS worker process that hosts web applications and executes HTTP requests within the boundaries of an application pool.

Question 42: Which IIS authentication method sends credentials as a base64-encoded string that can easily be decoded?

Basic Authentication (Correct answer)
Windows Authentication
Forms Authentication
Digest Authentication

Correct answer: Basic Authentication

Basic Authentication encodes credentials in base64, which provides no real encryption and should only be used over HTTPS.

Question 43: Which Windows performance counter tracks the number of current connections to all IIS websites?

W3WP\Active Requests
Web Service\Current Connections (Correct answer)
IIS\Connection Count
HTTP Service\Total Connections

Correct answer: Web Service\Current Connections

The Web Service\Current Connections counter in Performance Monitor shows live connection counts for IIS.

Question 44: What does the 'Generate Process Model Event Log Entry' setting control in an IIS application pool?

Whether Failed Request Tracing logs are generated for the pool
Whether IIS writes HTTP access entries to the W3C log files
Whether recycling and shutdown events are written to the Windows Event Log (Correct answer)
Whether Windows Performance Monitor collects data from the pool

Correct answer: Whether recycling and shutdown events are written to the Windows Event Log

This setting controls whether IIS writes events to the Windows Application Event Log when an application pool recycles or shuts down, aiding in operational monitoring.

Question 45: A QA standard requires confirming that IIS binds only to necessary IP addresses and ports. Which IIS Manager section lists and controls these bindings per site?

Application Pool identity settings
SSL Settings feature
IP and Domain Restrictions feature
Site Bindings in Edit Site dialog (Correct answer)

Correct answer: Site Bindings in Edit Site dialog

The Site Bindings dialog for each IIS website shows and controls which IP addresses, ports, and host names the site listens on.

Question 46: Which IIS feature allows an old worker process to continue serving requests while a new one initializes during recycling?

Overlapped recycling (Correct answer)
Always Running startup mode
Zero-downtime restart
Rapid Fail Protection

Correct answer: Overlapped recycling

Overlapped recycling lets the existing worker process continue handling requests until the newly started worker process is fully initialized and ready to accept traffic.

Question 47: Which IIS module provides rule-based URL rewriting, including enforcing HTTPS redirects?

URL Rewrite Module (Correct answer)
Rewrite Cache
ARR (Application Request Routing)
HTTP Redirect

Correct answer: URL Rewrite Module

The URL Rewrite Module allows pattern-based rules to redirect HTTP to HTTPS and many other URL transformations.

Question 48: What SSL/TLS binding type in IIS 8+ allows multiple SSL certificates on one IP address using SNI?

Wildcard binding
SNI (Server Name Indication) (Correct answer)
IP-based SSL
SAN certificate binding

Correct answer: SNI (Server Name Indication)

SNI bindings let IIS serve different SSL certificates on the same IP and port by reading the hostname in the TLS handshake.

Question 49: What authentication method in IIS 4.0 sends credentials encrypted using an MD5 hash?

Digest (Correct answer)
Anonymous
Basic
NTLM

Correct answer: Digest

Digest authentication uses an MD5 hash of credentials, unlike Basic which sends them base64-encoded.

Question 50: What is the default identity under which IIS application pool worker processes run?

ApplicationPoolIdentity (Correct answer)
NETWORK SERVICE
IUSR
LOCAL SYSTEM

Correct answer: ApplicationPoolIdentity

Since IIS 7.5, application pools default to the ApplicationPoolIdentity, a least-privilege virtual account unique to each pool.

Question 51: What is the default identity used by an IIS application pool in IIS 7.5 and later?

ApplicationPoolIdentity (Correct answer)
Local System
Local Service
Network Service

Correct answer: ApplicationPoolIdentity

Starting with IIS 7.5, the default identity for application pools is ApplicationPoolIdentity, which creates a unique virtual account per pool with minimal privileges.

Question 52: Which HTTP error code does IIS return when the application pool is set to queue requests and the queue limit is exceeded?

502
500
503 (Correct answer)
429

Correct answer: 503

When the IIS request queue is full, IIS returns HTTP 503 Service Unavailable to indicate the server cannot accept more requests.

Question 53: Where is an SSL/TLS certificate bound to an IIS website configured?

In the application pool advanced settings
In applicationHost.config directly only
In the site Bindings dialog under HTTPS port 443 (Correct answer)
In the Windows certificate store only, not in IIS Manager

Correct answer: In the site Bindings dialog under HTTPS port 443

You bind an SSL certificate to a site by editing its Bindings in IIS Manager, selecting HTTPS, port 443, and the certificate.

Question 54: In IIS, what does the 'preloadEnabled' setting on a web application do?

Initializes SSL sessions in advance
Sends a fake request to warm up the application before real traffic arrives (Correct answer)
Pre-compiles ASP.NET views on deploy
Loads static assets into the kernel cache at startup

Correct answer: Sends a fake request to warm up the application before real traffic arrives

When preloadEnabled is true, IIS sends an initialization request to the application during startup so the first real user does not experience cold-start latency.

Question 55: In the context of IIS and ASP.NET, what does 'integrated pipeline mode' mean?

IIS merges multiple worker processes into a single shared pipeline
ASP.NET requests are processed through a separate pipeline bypassing IIS modules
ASP.NET and PHP share the same request handler in a unified queue
ASP.NET modules participate in the same unified request processing pipeline as native IIS modules (Correct answer)

Correct answer: ASP.NET modules participate in the same unified request processing pipeline as native IIS modules

In integrated pipeline mode, ASP.NET modules (like authentication or custom HttpModules) run within IIS's unified request pipeline, enabling them to process all request types including static files.

Question 56: What HTTP status code does IIS return when a requested resource is not found?

500
403
404 (Correct answer)
503

Correct answer: 404

HTTP 404 Not Found means IIS received the request but could not locate the file or resource at the specified URL.

Implementing and Supporting Microsoft Internet Information Server (IIS)

Validates skills in planning, installing, configuring, securing, and administering Microsoft Internet Information Services (IIS), including web server management, security hardening, application pools, and performance monitoring.

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds