Microsoft Internet Information Server Regulatory Frameworks & Compliance 2

Question 1

Under HIPAA Security Rule, which IIS configuration helps protect electronic Protected Health Information (ePHI) in transit?

Accepted Answer

Enforcing TLS 1.2 or higher with HTTPS bindings

Answer

HIPAA requires encryption of ePHI in transit, which is satisfied by configuring IIS HTTPS bindings with TLS 1.2 or higher.

Question 2

Which IIS logging field is most critical for demonstrating PCI DSS Requirement 10 (audit trail) compliance?

Accepted Answer

c-ip combined with cs-uri-stem and sc-status

Answer

PCI DSS Requirement 10 mandates capturing user access, source IP, resource accessed, and response code — all provided by the c-ip, cs-uri-stem, and sc-status fields.

Question 3

GDPR Article 32 requires 'appropriate technical measures' for data security. Which IIS feature directly supports this for web applications?

Accepted Answer

Request Filtering to block malicious inputs and reduce attack surface

Answer

Request Filtering enforces rules that block malicious HTTP inputs, directly reducing the attack surface as required by GDPR's technical security measures obligation.

Question 4

A financial institution must comply with SOX IT controls. Which IIS setting best supports change management documentation requirements?

Accepted Answer

Using IIS Configuration History to track applicationHost.config changes

Answer

IIS Configuration History automatically saves snapshots of applicationHost.config, providing an audit trail of configuration changes that supports SOX IT change management controls.

Question 5

NIST SP 800-44 (Web Server Security Guide) recommends which practice for IIS operating system hardening?

Accepted Answer

Removing unnecessary IIS modules and Windows components not required for the web server's function

Answer

NIST SP 800-44 recommends a minimal installation approach — removing unneeded services and modules to reduce the attack surface of the web server.

Microsoft Internet Information Server Practice Test

Microsoft Internet Information Server Practice Test

Microsoft Internet Information Server Regulatory Frameworks & Compliance 2