Microsoft Internet Information Server Regulatory Frameworks & Compliance 3

Question 1

Which IIS SSL/TLS configuration violates FIPS 140-2 compliance requirements used in US government systems?

Accepted Answer

Enabling RC4 or DES cipher suites

Answer

RC4 and DES are not FIPS 140-2 approved algorithms; enabling them on IIS violates federal FIPS compliance requirements for cryptographic modules.

Question 2

Under PCI DSS Requirement 6.4, which IIS practice helps protect web applications from the OWASP Top 10?

Accepted Answer

Deploying a Web Application Firewall (WAF) and keeping IIS patches current

Answer

PCI DSS Requirement 6.4 mandates protecting public-facing web applications via a WAF or regular vulnerability assessments, alongside maintaining current patches.

Question 3

COPPA (Children's Online Privacy Protection Act) compliance for a website hosted on IIS requires which configuration consideration?

Accepted Answer

Implementing strict access controls and HTTPS to protect personal data collected from children under 13

Answer

COPPA requires verifiable parental consent and protection of children's personal data; IIS must enforce HTTPS and access controls as baseline technical safeguards.

Question 4

A SOC 2 Type II audit examines the effectiveness of controls over time. Which IIS feature provides evidence of consistent security control operation for auditors?

Accepted Answer

Centralized W3C log files with timestamps retained per retention policy

Answer

SOC 2 Type II auditors review log evidence over the audit period; W3C log files with timestamps and defined retention demonstrate consistent operational control.

Question 5

Which Windows Server Group Policy setting, when applied to an IIS server, directly supports STIG (Security Technical Implementation Guide) compliance for account lockout?

Accepted Answer

Configure account lockout threshold to 3 invalid attempts

Answer

DISA STIGs for Windows Server require account lockout after a defined number of failed attempts (typically 3) to prevent brute-force attacks against IIS-authenticated resources.

Microsoft Internet Information Server Practice Test

Microsoft Internet Information Server Practice Test

Microsoft Internet Information Server Regulatory Frameworks & Compliance 3