Microsoft Internet Information Server Regulatory Frameworks & Compliance 2 — Questions and Answers
Question 1: Under HIPAA Security Rule, which IIS configuration helps protect electronic Protected Health Information (ePHI) in transit?
- Enabling HTTP/1.0 only
- Enforcing TLS 1.2 or higher with HTTPS bindings (Correct answer)
- Disabling SSL certificates to reduce overhead
- Using Basic Authentication without encryption
Correct answer: Enforcing TLS 1.2 or higher with HTTPS bindings
HIPAA requires encryption of ePHI in transit, which is satisfied by configuring IIS HTTPS bindings with TLS 1.2 or higher.
Question 2: Which IIS logging field is most critical for demonstrating PCI DSS Requirement 10 (audit trail) compliance?
- cs-bytes
- time-taken
- c-ip combined with cs-uri-stem and sc-status (Correct answer)
- s-sitename only
Correct answer: c-ip combined with cs-uri-stem and sc-status
PCI DSS Requirement 10 mandates capturing user access, source IP, resource accessed, and response code — all provided by the c-ip, cs-uri-stem, and sc-status fields.
Question 3: GDPR Article 32 requires 'appropriate technical measures' for data security. Which IIS feature directly supports this for web applications?
- IIS Manager user delegation
- Request Filtering to block malicious inputs and reduce attack surface (Correct answer)
- Anonymous authentication for all endpoints
- Disabling failed request tracing
Correct answer: Request Filtering to block malicious inputs and reduce attack surface
Request Filtering enforces rules that block malicious HTTP inputs, directly reducing the attack surface as required by GDPR's technical security measures obligation.
Question 4: A financial institution must comply with SOX IT controls. Which IIS setting best supports change management documentation requirements?
- Enabling directory browsing
- Using IIS Configuration History to track applicationHost.config changes (Correct answer)
- Running all sites under LocalSystem account
- Disabling Windows Event logging
Correct answer: Using IIS Configuration History to track applicationHost.config changes
IIS Configuration History automatically saves snapshots of applicationHost.config, providing an audit trail of configuration changes that supports SOX IT change management controls.
Question 5: NIST SP 800-44 (Web Server Security Guide) recommends which practice for IIS operating system hardening?
- Installing all available IIS role services to maximize feature availability
- Removing unnecessary IIS modules and Windows components not required for the web server's function (Correct answer)
- Enabling WebDAV on all production servers by default
- Granting IIS_IUSRS full control over the system drive
Correct answer: Removing unnecessary IIS modules and Windows components not required for the web server's function
NIST SP 800-44 recommends a minimal installation approach — removing unneeded services and modules to reduce the attack surface of the web server.
Question 6: Which IIS authentication method is explicitly prohibited by most federal compliance frameworks (FedRAMP, FISMA) when used alone over HTTP?
- Windows Authentication (Kerberos)
- Client Certificate Authentication
- Basic Authentication without TLS/SSL (Correct answer)
- Digest Authentication over HTTPS
Correct answer: Basic Authentication without TLS/SSL
Basic Authentication transmits credentials as Base64-encoded plaintext; without TLS, credentials are exposed in transit, making it prohibited by FedRAMP and FISMA over unencrypted HTTP.
Question 7: For CIS Microsoft IIS Benchmark compliance, what is the recommended setting for the 'maxAllowedContentLength' Request Filtering property?
- Leave it at the default of unlimited
- Set it as high as possible to avoid blocking legitimate traffic
- Configure a defined limit appropriate to the application to prevent large-payload attacks (Correct answer)
- Set it to zero to block all POST requests
Correct answer: Configure a defined limit appropriate to the application to prevent large-payload attacks
The CIS IIS Benchmark recommends setting maxAllowedContentLength to a defined, application-appropriate value to mitigate denial-of-service attacks via oversized request bodies.
Microsoft Internet Information Server Regulatory Frameworks & Compliance 2
Under HIPAA Security Rule, which IIS configuration helps protect electronic Protected Health Information (ePHI) in transit?