Microsoft Internet Information Server Professional Standards & Competencies 3 — Questions and Answers
Question 1: An IIS professional is reviewing change management practices. Which file should be version-controlled to track all IIS site and application pool configurations?
- machine.config
- applicationHost.config (Correct answer)
- web.config of the default site
- inetpub\wwwroot\web.config
Correct answer: applicationHost.config
applicationHost.config is the master IIS configuration file containing all site, application pool, and global settings and should be version-controlled.
Question 2: A compliance audit requires demonstrating that IIS is patched to current security standards. Which Microsoft resource provides authoritative patch guidance for IIS?
- IIS.net community forums
- Microsoft Security Update Guide (MSRC) (Correct answer)
- TechNet library archived pages
- IIS Manager update notifications
Correct answer: Microsoft Security Update Guide (MSRC)
The Microsoft Security Response Center (MSRC) Security Update Guide is the authoritative source for IIS CVEs, patches, and severity ratings.
Question 3: Which professional practice should an IIS administrator follow before applying a major IIS update to a production server?
- Apply directly to production and monitor logs
- Test on a staging environment that mirrors production, then promote (Correct answer)
- Disable antivirus and apply the update
- Run iisreset before the update to clear caches
Correct answer: Test on a staging environment that mirrors production, then promote
Testing updates on a staging environment that mirrors production before promoting changes is a fundamental change management best practice.
Question 4: An IIS administrator documents that request filtering blocks .exe file downloads. Which configuration element enforces this in web.config?
- <httpHandlers> deny .exe</httpHandlers>
- <requestFiltering><fileExtensions><add fileExtension='.exe' allowed='false'/></fileExtensions></requestFiltering> (Correct answer)
- <security><access sslFlags='Ssl'/></security>
- <mimeMap fileExtension='.exe' mimeType='application/deny'/>
Correct answer: <requestFiltering><fileExtensions><add fileExtension='.exe' allowed='false'/></fileExtensions></requestFiltering>
The requestFiltering fileExtensions element with allowed='false' blocks requests for files with the specified extension.
Question 5: Which professional practice helps ensure IIS high availability for a business-critical web application?
- Running all sites in the DefaultAppPool
- Implementing Network Load Balancing (NLB) across multiple IIS servers (Correct answer)
- Increasing the application pool recycling interval to 0
- Disabling health monitoring to reduce overhead
Correct answer: Implementing Network Load Balancing (NLB) across multiple IIS servers
Network Load Balancing distributes traffic across multiple IIS nodes, eliminating single points of failure and ensuring high availability.
Question 6: A security team requires that IIS log all inbound request headers for forensic purposes. Which IIS logging feature supports adding custom fields?
- W3C Extended log format with custom fields enabled (Correct answer)
- NCSA Common log format
- IIS Binary logging
- ETW (Event Tracing for Windows) only
Correct answer: W3C Extended log format with custom fields enabled
W3C Extended logging in IIS supports adding custom log fields including request headers, making it suitable for forensic requirements.
Question 7: When decommissioning an IIS server, which professional obligation must be met regarding stored TLS private keys?
- Export the private key to a USB drive and store it in a drawer
- Securely delete or revoke the certificate and destroy the private key (Correct answer)
- Leave the certificate in place for future reference
- Transfer the private key via email to the security team
Correct answer: Securely delete or revoke the certificate and destroy the private key
Professional security standards require revoking the certificate at the CA and securely destroying the private key when decommissioning a server.
Microsoft Internet Information Server Professional Standards & Competencies 3
An IIS professional is reviewing change management practices.
Which file should be version-controlled to track all IIS site and application pool configurations?