Microsoft Internet Information Server Professional Standards & Competencies 5 — Questions and Answers
Question 1: An IIS professional is conducting a post-incident review after a web defacement. Which IIS log analysis skill is most relevant to determine how the attacker gained access?
- Reviewing W3C access logs for unusual HTTP PUT or POST requests with suspicious user-agents (Correct answer)
- Checking the Windows Update history for missing patches
- Reviewing DNS query logs for the domain
- Analyzing SSL certificate expiry dates
Correct answer: Reviewing W3C access logs for unusual HTTP PUT or POST requests with suspicious user-agents
W3C access logs record HTTP method, URI, user-agent, and status codes, which can reveal unauthorized PUT/POST requests used for defacement.
Question 2: Which IIS competency involves configuring health check URLs so that an upstream load balancer can automatically remove a failing IIS node from rotation?
- Application Request Routing (ARR) health check probe configuration (Correct answer)
- IIS Failed Request Tracing setup
- Application pool rapid-fail protection threshold
- HTTP compression configuration
Correct answer: Application Request Routing (ARR) health check probe configuration
ARR's server farm health check configuration defines a probe URL and interval, allowing ARR to remove unhealthy IIS servers from the load-balanced pool.
Question 3: A professional IIS deployment uses HTTPS exclusively. Which HTTP response header should be added to prevent browsers from ever connecting over plain HTTP again?
- X-Frame-Options: DENY
- Strict-Transport-Security: max-age=31536000; includeSubDomains (Correct answer)
- X-Content-Type-Options: nosniff
- Referrer-Policy: no-referrer
Correct answer: Strict-Transport-Security: max-age=31536000; includeSubDomains
The HTTP Strict Transport Security (HSTS) header instructs browsers to always use HTTPS for the specified duration, preventing downgrade attacks.
Question 4: When an IIS server is deployed in a DMZ, which professional network security practice should accompany the IIS hardening effort?
- Open all ports on the firewall to ensure maximum connectivity
- Apply host-based firewall rules allowing only ports 80 and 443 inbound and restrict outbound connections (Correct answer)
- Disable the Windows Firewall on the IIS server to avoid conflicts
- Allow all outbound traffic to enable Windows Update
Correct answer: Apply host-based firewall rules allowing only ports 80 and 443 inbound and restrict outbound connections
DMZ servers should have host-based firewalls permitting only required inbound ports and restricting outbound to minimize attack surface.
Question 5: An IIS administrator is asked to prove that the web server configuration matches the CIS IIS benchmark. Which tool automates this compliance check?
- IIS Manager's feature delegation panel
- Microsoft Security Compliance Toolkit or CIS-CAT scanner (Correct answer)
- Disk Cleanup utility
- Internet Explorer's developer tools
Correct answer: Microsoft Security Compliance Toolkit or CIS-CAT scanner
CIS-CAT and the Microsoft Security Compliance Toolkit can automatically assess whether IIS configuration meets CIS benchmark or Microsoft security baseline requirements.
Question 6: Which scenario best demonstrates an IIS professional applying the principle of least privilege to file system permissions?
- Granting Everyone Full Control on the wwwroot folder for simplicity
- Granting the application pool identity Read-only access on static content and Read+Execute on scripts (Correct answer)
- Giving the IUSR account Modify permission on all site directories
- Assigning LocalSystem to the application pool for unrestricted file access
Correct answer: Granting the application pool identity Read-only access on static content and Read+Execute on scripts
Granting only Read on static files and Read+Execute on scripts to the specific application pool identity follows least-privilege file system principles.
Question 7: A professional IIS deployment must support disaster recovery with an RTO of under one hour. Which approach best achieves this for IIS configuration?
- Manually reconfigure IIS from memory after an outage
- Automate IIS configuration deployment using PowerShell DSC or Web Deploy backup/restore scripts (Correct answer)
- Keep a printed copy of applicationHost.config in a binder
- Rely on tape backups restored manually by a technician
Correct answer: Automate IIS configuration deployment using PowerShell DSC or Web Deploy backup/restore scripts
PowerShell DSC or Web Deploy scripted deployments can rebuild an IIS configuration in minutes, easily meeting sub-one-hour RTO objectives.
Microsoft Internet Information Server Professional Standards & Competencies 5
An IIS professional is conducting a post-incident review after a web defacement.
Which IIS log analysis skill is most relevant to determine how the attacker gained access?