Microsoft Internet Information Server Professional Standards & Competencies 4 — Questions and Answers
Question 1: An IIS admin is asked to implement content security policy headers to prevent XSS attacks. Where should these headers be added?
- In the DNS configuration for the domain
- As HTTP response headers in IIS Manager or web.config <customHeaders> (Correct answer)
- In the SSL certificate metadata
- Via the application pool environment variables
Correct answer: As HTTP response headers in IIS Manager or web.config <customHeaders>
HTTP response headers such as Content-Security-Policy are configured in IIS Manager's HTTP Response Headers feature or the web.config <customHeaders> element.
Question 2: A web server professional must limit the maximum allowed HTTP request size to prevent buffer overflow attacks on an IIS server. Which setting controls this?
- maxRequestEntityAllowed in <requestFiltering> (Correct answer)
- maxConnections in <serverRuntime>
- queueLength in <applicationPools>
- maxBandwidth in <limits>
Correct answer: maxRequestEntityAllowed in <requestFiltering>
The maxRequestEntityAllowed attribute in the <requestFiltering> element limits the maximum allowed size of the HTTP request body.
Question 3: Which professional monitoring approach helps detect memory leaks in an IIS-hosted application before they cause production outages?
- Check IIS logs for 404 errors
- Monitor the w3wp.exe process memory counters in Performance Monitor (Correct answer)
- Review the Windows Application Event Log weekly
- Use iisreset daily as a preventive measure
Correct answer: Monitor the w3wp.exe process memory counters in Performance Monitor
Tracking the w3wp.exe private bytes counter in Performance Monitor reveals growing memory consumption indicative of leaks before they cause crashes.
Question 4: An IIS administrator must configure WebDAV and ensure only authenticated users can publish content. Which two settings are required?
- Enable WebDAV and set authoring rules to allow specific roles with authentication required (Correct answer)
- Install WebDAV and allow anonymous access for publishing convenience
- Enable WebDAV and disable request filtering
- Install WebDAV and grant Everyone full NTFS permissions on the web root
Correct answer: Enable WebDAV and set authoring rules to allow specific roles with authentication required
WebDAV authoring rules must restrict publishing to authenticated roles, and Windows Authentication must be enabled to prevent anonymous publishing.
Question 5: Which IIS feature should a professional configure to automatically restart a worker process that stops responding, ensuring application resilience?
- Application pool rapid-fail protection
- Application pool ping settings (ping enabled, ping maximum response time) (Correct answer)
- HTTP Keep-Alive timeout
- IIS Failed Request Tracing
Correct answer: Application pool ping settings (ping enabled, ping maximum response time)
Application pool ping settings detect unresponsive worker processes and automatically recycle them when they fail to respond within the configured interval.
Question 6: A company policy requires separating web applications by department to minimize security blast radius. Which IIS architectural approach best satisfies this?
- Host all applications in the default web site under different virtual directories
- Use separate application pools with unique identities for each department's application (Correct answer)
- Share a single application pool for simplicity
- Run all applications as LocalSystem for maximum permissions
Correct answer: Use separate application pools with unique identities for each department's application
Isolating each department's application in its own application pool with a unique identity limits the impact of a compromise to that pool only.
Question 7: Which document type should an IIS professional maintain to describe the server's installed roles, configuration baselines, and change history?
- A marketing brochure for the server hardware
- A server build document / configuration baseline document (Correct answer)
- A DNS zone file export
- An SSL certificate CSR file
Correct answer: A server build document / configuration baseline document
A server build or configuration baseline document records the server's intended state, enabling audits, rebuilds, and change tracking.
Microsoft Internet Information Server Professional Standards & Competencies 4
An IIS admin is asked to implement content security policy headers to prevent XSS attacks.
Where should these headers be added?