Microsoft Internet Information Server Case Studies & Practical Application 5 — Questions and Answers
Question 1: A government agency requires that the IIS server only accepts cipher suites approved by NIST. Beyond registry changes, what tool simplifies enforcing approved cipher suite ordering on Windows Server?
- IIS Crypto (third-party GUI tool) or Group Policy's SSL Cipher Suite Order setting (Correct answer)
- IIS Manager SSL Settings dialog
- Netsh http commands to set cipher suites
- Windows Firewall Advanced Security inbound rules
Correct answer: IIS Crypto (third-party GUI tool) or Group Policy's SSL Cipher Suite Order setting
Group Policy's SSL Cipher Suite Order under Computer Configuration or tools like IIS Crypto provide a straightforward way to enforce NIST-approved cipher suite ordering on Windows Server.
Question 2: An IIS site is experiencing HTTP 503 errors intermittently. The event log shows 'WAS failed to start worker process for application pool'. What is the most common cause?
- The application pool identity account password has expired or been changed (Correct answer)
- The site's SSL certificate is self-signed
- Too many concurrent requests exceeding the queue limit
- The applicationHost.config file is corrupted
Correct answer: The application pool identity account password has expired or been changed
When the application pool identity's account password expires or is reset, WAS cannot launch the worker process, resulting in 503 Service Unavailable errors.
Question 3: A company's IIS-hosted e-commerce site must store uploaded product images outside the web root for security. The ASP.NET application needs to serve these images via a custom handler. What is the cleanest IIS approach?
- Map a virtual directory in IIS pointing to the external folder and set appropriate permissions (Correct answer)
- Use a URL Rewrite rule to proxy requests to a separate file server
- Copy images to the wwwroot after upload using a scheduled task
- Serve images directly from the database as binary streams
Correct answer: Map a virtual directory in IIS pointing to the external folder and set appropriate permissions
A virtual directory mapped to an external folder lets IIS serve files outside the web root while the NTFS permissions on that folder control access independently.
Question 4: An administrator is troubleshooting a 404 error for a route that exists in an ASP.NET MVC application. The same route works on the developer's machine running IIS Express. What IIS setting is most likely missing on the server?
- runAllManagedModulesForAllRequests='true' or a specific ExtensionlessUrl handler mapping in web.config (Correct answer)
- An HTTPS binding for the site
- The Static Content role service in Windows Server
- An inbound rule in Windows Firewall for port 80
Correct answer: runAllManagedModulesForAllRequests='true' or a specific ExtensionlessUrl handler mapping in web.config
IIS Express includes extensionless URL handling by default; full IIS requires runAllManagedModulesForAllRequests or explicit handler mappings for extensionless MVC routes.
Question 5: A DevOps team wants to automate IIS site configuration across 20 servers using infrastructure-as-code principles. Which Microsoft tooling is best suited for this?
- PowerShell Desired State Configuration (DSC) with the xWebAdministration or WebAdministration DSC resource (Correct answer)
- Manual export of applicationHost.config and xcopy to all servers
- IIS Manager's shared configuration feature pointing to a network share
- Batch scripts using appcmd.exe deployed via Group Policy
Correct answer: PowerShell Desired State Configuration (DSC) with the xWebAdministration or WebAdministration DSC resource
PowerShell DSC with IIS-specific resources declaratively defines and enforces IIS configuration state across all servers, aligning with infrastructure-as-code practices.
Question 6: An IIS server's disk is filling up rapidly. Investigation reveals that Failed Request Tracing logs are consuming gigabytes of space daily. What is the correct remediation?
- Scope Failed Request Tracing rules to only capture specific status codes or time thresholds, and set a log file count limit (Correct answer)
- Disable the IIS logging service entirely
- Move the website's content to a larger drive
- Compress the IIS log folder using NTFS compression
Correct answer: Scope Failed Request Tracing rules to only capture specific status codes or time thresholds, and set a log file count limit
Narrowing FRT rules to specific conditions (e.g., only 500 errors or requests exceeding 30 seconds) and capping the maximum log file count prevents uncontrolled disk usage.
Question 7: A SaaS company uses IIS ARR as a reverse proxy for multiple backend APIs. They need to route requests to different backends based on the URL prefix (/api/v1 vs /api/v2). What ARR feature enables this?
- Server Farm health check rules
- URL Rewrite rules combined with ARR server farms using route-to-server-farm actions (Correct answer)
- HTTP Redirect rules in each site's bindings
- ARR's load balancing algorithm set to URL hash
Correct answer: URL Rewrite rules combined with ARR server farms using route-to-server-farm actions
URL Rewrite rules inspect the URL prefix and route matching requests to the appropriate ARR server farm, enabling path-based routing to different backend clusters.
Microsoft Internet Information Server Case Studies & Practical Application 5
A government agency requires that the IIS server only accepts cipher suites approved by NIST.
Beyond registry changes, what tool simplifies enforcing approved cipher suite ordering on Windows Server?