Microsoft Internet Information Server Professional Standards & Competencies 2 — Questions and Answers
Question 1: A company's security policy requires that all IIS server banners be removed to prevent information disclosure. Which configuration achieves this in IIS 10?
- Set the Server header to 'None' in web.config
- Use the HTTP Response Headers feature to remove the X-Powered-By header only
- Use the URL Rewrite module outbound rule to delete the Server response header (Correct answer)
- Disable the HTTP Logging feature in IIS Manager
Correct answer: Use the URL Rewrite module outbound rule to delete the Server response header
The URL Rewrite module's outbound rules can remove or replace the Server response header, which IIS does not allow removal of through native settings alone.
Question 2: According to IIS best practices, which application pool identity provides the least privilege for running a standard web application?
- LocalSystem
- NetworkService
- ApplicationPoolIdentity (Correct answer)
- LocalService
Correct answer: ApplicationPoolIdentity
ApplicationPoolIdentity creates a unique virtual account per pool with minimal permissions, making it the least-privileged and recommended identity.
Question 3: An IIS administrator needs to ensure that SSL 3.0 is disabled server-wide to comply with PCI DSS. Where is this setting configured?
- IIS Manager > SSL Settings
- Windows Registry under SCHANNEL\Protocols (Correct answer)
- Server certificates MMC snap-in
- ApplicationHost.config SSL element
Correct answer: Windows Registry under SCHANNEL\Protocols
SSL/TLS protocol versions are controlled via the Windows Registry under HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols.
Question 4: Which IIS feature allows an administrator to define custom error pages that do not expose stack traces to end users, meeting security best practices?
- Failed Request Tracing
- Custom Error Pages (errorMode=Custom) (Correct answer)
- HTTP Logging
- Request Filtering
Correct answer: Custom Error Pages (errorMode=Custom)
Setting errorMode to Custom in the IIS Error Pages feature ensures users see custom pages rather than detailed server error messages.
Question 5: A professional IIS deployment requires auditing all failed login attempts to IIS-hosted applications. Which Windows feature should be enabled?
- IIS HTTP Logging
- Windows Security Auditing for Logon Events (Correct answer)
- IIS Request Filtering logs
- Failed Request Tracing (FREB)
Correct answer: Windows Security Auditing for Logon Events
Windows Security Auditing for Logon/Logoff events logs authentication failures to the Windows Security Event Log, meeting audit compliance requirements.
Question 6: When deploying a web application to IIS, which practice ensures that application configuration secrets are not stored in plain text within web.config?
- Encrypt configuration sections using aspnet_regiis -pe (Correct answer)
- Store secrets in the IIS application pool identity
- Use HTTP compression on the web.config file
- Set web.config as a hidden file in NTFS
Correct answer: Encrypt configuration sections using aspnet_regiis -pe
The aspnet_regiis.exe tool with the -pe flag encrypts sensitive web.config sections using DPAPI or RSA key containers.
Question 7: Which IIS competency is demonstrated by configuring dynamic IP address restrictions to block clients making excessive requests per second?
- Performance tuning
- DoS/DDoS mitigation using IP Restriction feature (Correct answer)
- Load balancing configuration
- SSL offloading
Correct answer: DoS/DDoS mitigation using IP Restriction feature
The Dynamic IP Restrictions extension in IIS can automatically block IPs that exceed a configured request rate, mitigating denial-of-service attacks.
Microsoft Internet Information Server Professional Standards & Competencies 2
A company's security policy requires that all IIS server banners be removed to prevent information disclosure.
Which configuration achieves this in IIS 10?