Microsoft Internet Information Server Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: Which IIS SSL/TLS configuration violates FIPS 140-2 compliance requirements used in US government systems?
- Using AES-256 cipher suites
- Enabling RC4 or DES cipher suites (Correct answer)
- Requiring mutual TLS with client certificates
- Using SHA-256 for certificate signatures
Correct answer: Enabling RC4 or DES cipher suites
RC4 and DES are not FIPS 140-2 approved algorithms; enabling them on IIS violates federal FIPS compliance requirements for cryptographic modules.
Question 2: Under PCI DSS Requirement 6.4, which IIS practice helps protect web applications from the OWASP Top 10?
- Disabling IIS application pools
- Deploying a Web Application Firewall (WAF) and keeping IIS patches current (Correct answer)
- Enabling directory browsing to verify file integrity
- Using Windows XP as the IIS host OS for stability
Correct answer: Deploying a Web Application Firewall (WAF) and keeping IIS patches current
PCI DSS Requirement 6.4 mandates protecting public-facing web applications via a WAF or regular vulnerability assessments, alongside maintaining current patches.
Question 3: COPPA (Children's Online Privacy Protection Act) compliance for a website hosted on IIS requires which configuration consideration?
- Enabling anonymous authentication to avoid collecting any user identity
- Implementing strict access controls and HTTPS to protect personal data collected from children under 13 (Correct answer)
- Using HTTP-only (no HTTPS) to keep implementation simple
- Storing children's data in IIS log files for easy retrieval
Correct answer: Implementing strict access controls and HTTPS to protect personal data collected from children under 13
COPPA requires verifiable parental consent and protection of children's personal data; IIS must enforce HTTPS and access controls as baseline technical safeguards.
Question 4: A SOC 2 Type II audit examines the effectiveness of controls over time. Which IIS feature provides evidence of consistent security control operation for auditors?
- IIS Manager graphical interface screenshots
- Centralized W3C log files with timestamps retained per retention policy (Correct answer)
- Default welcome page content
- IIS Express configuration files
Correct answer: Centralized W3C log files with timestamps retained per retention policy
SOC 2 Type II auditors review log evidence over the audit period; W3C log files with timestamps and defined retention demonstrate consistent operational control.
Question 5: Which Windows Server Group Policy setting, when applied to an IIS server, directly supports STIG (Security Technical Implementation Guide) compliance for account lockout?
- Set maximum password age to 0 (never expires)
- Configure account lockout threshold to 3 invalid attempts (Correct answer)
- Enable the Guest account for anonymous access
- Disable the Windows Firewall service
Correct answer: Configure account lockout threshold to 3 invalid attempts
DISA STIGs for Windows Server require account lockout after a defined number of failed attempts (typically 3) to prevent brute-force attacks against IIS-authenticated resources.
Question 6: For GDPR compliance, an IIS server storing EU user session data must implement which log data handling practice?
- Retain all logs indefinitely for maximum forensic capability
- Log and retain IP addresses and user data only as long as necessary, with a defined retention and deletion policy (Correct answer)
- Share logs publicly to demonstrate transparency
- Disable logging entirely to avoid storing personal data
Correct answer: Log and retain IP addresses and user data only as long as necessary, with a defined retention and deletion policy
GDPR's data minimization and storage limitation principles require that personal data in logs (such as IP addresses) be retained only as long as necessary with documented retention policies.
Question 7: Which IIS header configuration is required by OWASP security guidelines and helps achieve compliance with frameworks that mandate clickjacking protection?
- Adding 'Server: Apache' to mask the server type
- Adding the 'X-Frame-Options: DENY' or 'SAMEORIGIN' custom response header (Correct answer)
- Removing the 'Content-Type' response header
- Setting 'Cache-Control: no-store' on all static resources
Correct answer: Adding the 'X-Frame-Options: DENY' or 'SAMEORIGIN' custom response header
The X-Frame-Options header prevents clickjacking by controlling whether a browser can render a page in a frame; OWASP and multiple compliance frameworks recommend it as a mandatory control.
Microsoft Internet Information Server Regulatory Frameworks & Compliance 3
Which IIS SSL/TLS configuration violates FIPS 140-2 compliance requirements used in US government systems?