Implementing and Supporting Microsoft Internet Information Server (IIS) — Questions and Answers

Question 1: What risk does enabling HTTP/2 without proper input validation present in IIS?

Slower page load times
HTTP/2 CONTINUATION frame flooding leading to DoS (Correct answer)
Broken certificate chains
Loss of URL rewrite rules

Correct answer: HTTP/2 CONTINUATION frame flooding leading to DoS

HTTP/2 CONTINUATION frame flooding (CVE-2024-27316) can exhaust server memory and cause denial of service if not properly controlled.

Question 2: A developer deploys a new ASP.NET Core app to IIS using the in-process hosting model. The site returns HTTP 500.30. What is the most likely cause?

The application pool identity lacks read permission on the wwwroot folder
The application pool is set to 32-bit mode
The SSL certificate has expired
The .NET Core Hosting Bundle is not installed on the server (Correct answer)

Correct answer: The .NET Core Hosting Bundle is not installed on the server

HTTP 500.30 indicates the ASP.NET Core in-process handler failed to start, most commonly because the .NET Core Hosting Bundle is missing.

Question 3: Which IIS feature limits the types of file extensions and HTTP verbs that can be requested?

Request Filtering (Correct answer)
MIME Types
Compression
Output Caching

Correct answer: Request Filtering

Request Filtering can block double-encoded requests, dangerous file extensions, HTTP verbs, and oversized requests.

Question 4: What is the most effective communication approach for Microsoft Internet Information Server professionals?

Using technical language exclusively
Minimizing all communications
Only written communication
Adapting communication style to the audience while maintaining accuracy and clarity (Correct answer)

Correct answer: Adapting communication style to the audience while maintaining accuracy and clarity

This is fundamental to Microsoft Internet Information Server practice. Adapting communication style to the audience while maintaining accuracy and clarity represents the professional standard for communication in the Microsoft Internet Information Server certification framework.

Question 5: A company's IIS-hosted e-commerce site must store uploaded product images outside the web root for security. The ASP.NET application needs to serve these images via a custom handler. What is the cleanest IIS approach?

Serve images directly from the database as binary streams
Use a URL Rewrite rule to proxy requests to a separate file server
Map a virtual directory in IIS pointing to the external folder and set appropriate permissions (Correct answer)
Copy images to the wwwroot after upload using a scheduled task

Correct answer: Map a virtual directory in IIS pointing to the external folder and set appropriate permissions

A virtual directory mapped to an external folder lets IIS serve files outside the web root while the NTFS permissions on that folder control access independently.

Question 6: What does the 'Require SSL' setting in IIS do when enabled for a site or application?

Automatically upgrades HTTP connections to HTTPS
Forces mutual TLS client certificate authentication
Returns a 403.4 error for any request that does not use HTTPS (Correct answer)
Blocks all external users

Correct answer: Returns a 403.4 error for any request that does not use HTTPS

When Require SSL is enabled, IIS rejects plain HTTP requests with a 403.4 Forbidden – SSL required error.

Question 7: How do Microsoft Internet Information Server professionals transfer knowledge from training to practice?

Through supervised practice, mentoring, gradual independence, and ongoing feedback (Correct answer)
Knowledge transfers automatically
By passing the certification exam only
Training and practice are unrelated

Correct answer: Through supervised practice, mentoring, gradual independence, and ongoing feedback

This is fundamental to Microsoft Internet Information Server practice. Through supervised practice, mentoring, gradual independence, and ongoing feedback represents the professional standard for practical in the Microsoft Internet Information Server certification framework.

Question 8: What does the 'Generate Process Model Event Log Entry' setting control in an IIS application pool?

Whether recycling and shutdown events are written to the Windows Event Log (Correct answer)
Whether Windows Performance Monitor collects data from the pool
Whether IIS writes HTTP access entries to the W3C log files
Whether Failed Request Tracing logs are generated for the pool

Correct answer: Whether recycling and shutdown events are written to the Windows Event Log

This setting controls whether IIS writes events to the Windows Application Event Log when an application pool recycles or shuts down, aiding in operational monitoring.

Question 9: What is the default maximum number of worker processes for a newly created IIS application pool?

2
4
1 (Correct answer)
8

Correct answer: 1

By default, a new IIS application pool is configured with a maximum of 1 worker process; increasing this value creates a Web Garden configuration with multiple workers.

Question 10: What tool can be used to test IIS connectivity and response headers from the command line?

appcmd.exe
netstat
curl (Correct answer)
IIS Manager

Correct answer: curl

Curl can send HTTP requests to IIS and display response headers and body, making it ideal for quick connectivity tests.

Question 11: What does enabling ETW (Event Tracing for Windows) logging in IIS allow you to do?

Trigger alerts when specific status codes are returned
Log IIS events to the Windows ETW infrastructure for real-time monitoring and low-overhead tracing (Correct answer)
Send logs to a remote syslog server automatically
Enable encrypted log storage

Correct answer: Log IIS events to the Windows ETW infrastructure for real-time monitoring and low-overhead tracing

ETW logging writes IIS request data to the Windows event tracing system, enabling high-performance real-time analysis with tools like PerfView.

Question 12: What key benefit does process isolation provide when using separate IIS application pools?

It enables request filtering to block malicious URLs across all pools
It enables output caching to be shared across multiple application pools
It allows URL authorization rules to be applied at the pool level
It prevents a crash or memory leak in one pool from affecting applications in other pools (Correct answer)

Correct answer: It prevents a crash or memory leak in one pool from affecting applications in other pools

Process isolation ensures each application pool runs in its own worker process so that a crash, memory leak, or runaway thread in one pool cannot destabilize applications in separate pools.

Question 13: Which IIS authentication method sends credentials as a base64-encoded string that can easily be decoded?

Digest Authentication
Windows Authentication
Forms Authentication
Basic Authentication (Correct answer)

Correct answer: Basic Authentication

Basic Authentication encodes credentials in base64, which provides no real encryption and should only be used over HTTPS.

Question 14: What action does IIS take when an application pool's idle timeout period expires?

The worker process is shut down to free server resources (Correct answer)
The worker process is recycled and restarted immediately
The application pool is permanently deleted from IIS configuration
The application pool is suspended but its configuration is preserved in memory

Correct answer: The worker process is shut down to free server resources

When idle timeout is reached with no incoming requests, IIS shuts down the worker process to conserve server resources until a new request triggers a restart.

Question 15: Which authentication scheme in IIS uses a hash of the credentials instead of sending them in clear text?

Digest Authentication (Correct answer)
Basic Authentication
Certificate Authentication
Anonymous Authentication

Correct answer: Digest Authentication

Digest Authentication sends an MD5 hash of the credentials over the network rather than plain text.

Question 16: A developer reports that a web application deployed to IIS is reading incorrect connection strings even though web.config looks correct. The server has multiple sites. What should you check?

Whether the application pool is running under a 32-bit process that reads a different config
Whether the connection string uses Windows Authentication instead of SQL auth
Whether a parent applicationHost.config or machine.config overrides the web.config setting (Correct answer)
Whether IIS caches the old web.config and needs an app pool restart

Correct answer: Whether a parent applicationHost.config or machine.config overrides the web.config setting

IIS configuration has a hierarchical inheritance model — machine.config, applicationHost.config, and parent web.config files can override child web.config values.

Question 17: In IIS application pools, what does 'pipeline mode' determine?

How requests are processed — either Integrated or Classic mode (Correct answer)
The sequence of HTTP compression modules applied to responses
The network pipeline used for routing requests between servers
The SSL/TLS pipeline used for encrypting secure connections

Correct answer: How requests are processed — either Integrated or Classic mode

Pipeline mode determines how IIS processes requests: Integrated mode merges the IIS and ASP.NET pipelines, while Classic mode processes them separately via ISAPI.

Question 18: Which IIS feature allows you to block requests from specific IP addresses or ranges?

URL Authorization
Dynamic IP Restrictions
IP Address and Domain Restrictions (Correct answer)
Request Filtering

Correct answer: IP Address and Domain Restrictions

The IP Address and Domain Restrictions feature in IIS lets you allow or deny access based on client IP addresses.

Question 19: Which IIS component provides support for running classic ASP and ASP.NET applications?

Application Development features (Correct answer)
Health and Diagnostics
Performance features
Common HTTP Features

Correct answer: Application Development features

The Application Development feature set in IIS includes ASP, ASP.NET, CGI, and ISAPI extensions.

Question 20: When researching IIS handler mapping security, which approach provides evidence that unnecessary handlers (like .asp legacy) are disabled?

Run netstat -an and look for open ports
Review NTFS permissions on wwwroot
Check Windows Update history
Query IIS handler mappings via appcmd list config /section:handlers and audit the list (Correct answer)

Correct answer: Query IIS handler mappings via appcmd list config /section:handlers and audit the list

Using appcmd to list configured handlers outputs the complete handler mapping table, providing documented evidence for the security audit trail.

Question 21: What type of IIS certificate mapping authenticates users based on client-side X.509 certificates?

Client Certificate Mapping Authentication (Correct answer)
Basic Authentication with certificates
Digest Authentication over TLS
Windows Token-Based Authentication

Correct answer: Client Certificate Mapping Authentication

Client Certificate Mapping Authentication in IIS maps an X.509 certificate presented by the browser to a Windows user account.

Question 22: A risk audit finds that IIS is serving responses with Server and X-Powered-By headers exposed. What risk does this introduce?

Information disclosure enabling targeted attacks (Correct answer)
Session fixation vulnerability
Increased bandwidth consumption
Cross-site request forgery

Correct answer: Information disclosure enabling targeted attacks

Exposing server version headers gives attackers precise version information to identify and exploit known CVEs.

Question 23: Which IIS log analysis tool, free from Microsoft, can parse W3C logs and produce visual evidence of request distribution, error rates, and top URLs?

Performance Monitor
Procmon
Log Parser 2.2 with Log Parser Studio (Correct answer)
Windows Event Viewer

Correct answer: Log Parser 2.2 with Log Parser Studio

Microsoft Log Parser 2.2 with the Log Parser Studio GUI allows SQL-like queries against W3C log files and generates charts as visual evidence for analysis.

Question 24: An IIS site hosting a REST API returns correct responses locally but clients receive truncated JSON when connecting through a corporate proxy. Compression is enabled. What should you investigate first?

Disable dynamic compression on the IIS site and retest (Correct answer)
Check if the proxy strips or modifies the Content-Encoding header
Increase the IIS response buffer size in applicationHost.config
Enable chunked transfer encoding in web.config

Correct answer: Disable dynamic compression on the IIS site and retest

Some proxies mishandle gzip-compressed responses, so disabling dynamic compression on IIS is the fastest way to isolate whether compression is the root cause.

Question 25: Which IIS header configuration is required by OWASP security guidelines and helps achieve compliance with frameworks that mandate clickjacking protection?

Adding 'Server: Apache' to mask the server type
Setting 'Cache-Control: no-store' on all static resources
Adding the 'X-Frame-Options: DENY' or 'SAMEORIGIN' custom response header (Correct answer)
Removing the 'Content-Type' response header

Correct answer: Adding the 'X-Frame-Options: DENY' or 'SAMEORIGIN' custom response header

The X-Frame-Options header prevents clickjacking by controlling whether a browser can render a page in a frame; OWASP and multiple compliance frameworks recommend it as a mandatory control.

Question 26: What is the default identity used by an IIS application pool in IIS 7.5 and later?

Network Service
Local Service
Local System
ApplicationPoolIdentity (Correct answer)

Correct answer: ApplicationPoolIdentity

Starting with IIS 7.5, the default identity for application pools is ApplicationPoolIdentity, which creates a unique virtual account per pool with minimal privileges.

Question 27: What authentication method in IIS 4.0 sends credentials encrypted using an MD5 hash?

NTLM
Digest (Correct answer)
Anonymous
Basic

Correct answer: Digest

Digest authentication uses an MD5 hash of credentials, unlike Basic which sends them base64-encoded.

Question 28: Which IIS security feature dynamically detects and blocks IP addresses that send too many requests?

Request Filtering
Dynamic IP Restrictions (Correct answer)
Request Monitor
IP Address and Domain Restrictions

Correct answer: Dynamic IP Restrictions

Dynamic IP Restrictions automatically denies IPs that exceed a configured request rate, helping mitigate DoS attacks.

Question 29: In IIS, which feature enables a single server to host multiple websites that share the same IP address and port using different domain names?

Application pool isolation
Host header-based virtual hosting (SNI) (Correct answer)
Port-based virtual hosting
IP-based virtual hosting

Correct answer: Host header-based virtual hosting (SNI)

Host header-based virtual hosting uses the HTTP Host header (and SNI for HTTPS) to differentiate multiple websites on the same IP:port combination.

Question 30: Which application pool recycling trigger causes the worker process to restart based on memory consumption?

Request queue limit
Connection timeout
Idle timeout
Virtual memory limit (Correct answer)

Correct answer: Virtual memory limit

The virtual memory limit setting causes IIS to recycle the worker process when it exceeds a specified amount of virtual memory allocation.

Implementing and Supporting Microsoft Internet Information Server (IIS)

Validates skills in planning, installing, configuring, securing, and administering Microsoft Internet Information Services (IIS), including web server management, security hardening, application pools, and performance monitoring.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds