Microsoft Internet Information Server Case Studies & Practical Application 3 — Questions and Answers
Question 1: A financial services company must log every HTTP request including query strings for compliance auditing. By default, IIS W3C logs omit query strings. What is the correct fix?
- Enable Failed Request Tracing for all status codes
- Add the cs-uri-query field to the W3C log fields selection in IIS Manager (Correct answer)
- Switch logging format from W3C to IIS (NCSA)
- Enable ETW trace logging in applicationHost.config
Correct answer: Add the cs-uri-query field to the W3C log fields selection in IIS Manager
The cs-uri-query field must be explicitly added to the W3C logging configuration to capture query strings in IIS access logs.
Question 2: An IIS site hosting a REST API returns correct responses locally but clients receive truncated JSON when connecting through a corporate proxy. Compression is enabled. What should you investigate first?
- Disable dynamic compression on the IIS site and retest (Correct answer)
- Increase the IIS response buffer size in applicationHost.config
- Check if the proxy strips or modifies the Content-Encoding header
- Enable chunked transfer encoding in web.config
Correct answer: Disable dynamic compression on the IIS site and retest
Some proxies mishandle gzip-compressed responses, so disabling dynamic compression on IIS is the fastest way to isolate whether compression is the root cause.
Question 3: During a security audit, the team finds that the IIS server reveals its version number in HTTP response headers. Which header should be removed or modified?
- X-Powered-By
- Server (Correct answer)
- X-AspNet-Version
- Content-Type
Correct answer: Server
The Server response header discloses the IIS version and should be removed using URL Rewrite outbound rules or the removeServerHeader attribute to reduce attack surface.
Question 4: A healthcare organization runs an IIS site that must comply with HIPAA. They need to ensure all HTTP traffic is redirected to HTTPS automatically. What is the best IIS-native approach?
- Set requireSSL='true' in web.config and use URL Rewrite to redirect HTTP to HTTPS (Correct answer)
- Delete the HTTP binding from the site and inform users to use HTTPS manually
- Use a firewall rule to block port 80 on the server
- Configure HSTS only, without a redirect rule
Correct answer: Set requireSSL='true' in web.config and use URL Rewrite to redirect HTTP to HTTPS
Combining a URL Rewrite redirect rule for HTTP-to-HTTPS with SSL Settings requireSSL ensures all traffic is encrypted and no unencrypted requests are served.
Question 5: An IIS application pool is configured with a recycling schedule at 3:00 AM. During recycling, users experience a brief service interruption. How can you eliminate this downtime?
- Disable application pool recycling entirely
- Enable Overlapped Recycle (the default behavior) and ensure the new worker process starts before the old one exits (Correct answer)
- Switch to a Web Garden with 4 worker processes
- Set the idle timeout to 0 to prevent worker process shutdown
Correct answer: Enable Overlapped Recycle (the default behavior) and ensure the new worker process starts before the old one exits
Overlapped recycling, which is on by default, starts the new worker process before terminating the old one, eliminating downtime during scheduled recycles.
Question 6: A developer reports that a web application deployed to IIS is reading incorrect connection strings even though web.config looks correct. The server has multiple sites. What should you check?
- Whether a parent applicationHost.config or machine.config overrides the web.config setting (Correct answer)
- Whether the application pool is running under a 32-bit process that reads a different config
- Whether IIS caches the old web.config and needs an app pool restart
- Whether the connection string uses Windows Authentication instead of SQL auth
Correct answer: Whether a parent applicationHost.config or machine.config overrides the web.config setting
IIS configuration has a hierarchical inheritance model — machine.config, applicationHost.config, and parent web.config files can override child web.config values.
Question 7: A retail site on IIS experiences CPU spikes every time a promotional email goes out, sending 50,000 concurrent users to the homepage. Which IIS feature best mitigates this without infrastructure changes?
- Enable output caching for the homepage with a short TTL (Correct answer)
- Increase the application pool worker process count (Web Garden)
- Enable HTTP compression to reduce bandwidth
- Set a connection limit in the site's connection throttling settings
Correct answer: Enable output caching for the homepage with a short TTL
Output caching serves the homepage from memory for multiple users without re-executing server-side code, drastically reducing CPU load during traffic spikes.
Microsoft Internet Information Server Case Studies & Practical Application 3
A financial services company must log every HTTP request including query strings for compliance auditing.
By default, IIS W3C logs omit query strings.
What is the correct fix?