Microsoft Internet Information Server Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: Which IIS configuration change is required to comply with PCI DSS Requirement 2.2.1 (one primary function per server)?
- Running multiple production web applications on a single IIS instance is always required
- Separating web, database, and application server roles onto dedicated servers or using strict isolation (Correct answer)
- Installing SQL Server on the same IIS host to simplify administration
- Combining development and production sites on one IIS server to save costs
Correct answer: Separating web, database, and application server roles onto dedicated servers or using strict isolation
PCI DSS Requirement 2.2.1 mandates that servers implement only one primary function to prevent different security levels from co-existing on the same system.
Question 2: FISMA requires continuous monitoring of federal information systems. Which IIS tool integrates best with SIEM solutions for this purpose?
- IIS Manager graphical console only
- Windows Event Forwarding (WEF) to stream IIS and Windows Security event logs to a SIEM (Correct answer)
- Manual log review once per year
- Disabling event logs to reduce system overhead
Correct answer: Windows Event Forwarding (WEF) to stream IIS and Windows Security event logs to a SIEM
Windows Event Forwarding enables real-time streaming of IIS and security events to centralized SIEM platforms, satisfying FISMA's continuous monitoring requirements.
Question 3: An IIS server handling credit card data must comply with PCI DSS Requirement 8.3 (MFA for non-console administrative access). Which implementation satisfies this?
- Using a shared administrator password known to the entire team
- Requiring multi-factor authentication for RDP and IIS Manager remote access to the cardholder data environment (Correct answer)
- Allowing single-factor username/password for all administrative logins
- Disabling remote administration to simplify the environment
Correct answer: Requiring multi-factor authentication for RDP and IIS Manager remote access to the cardholder data environment
PCI DSS Requirement 8.3 mandates MFA for all non-console administrative access into the cardholder data environment, including RDP sessions to IIS servers.
Question 4: Which IIS feature should be disabled to comply with DISA STIG V-76681 (preventing information disclosure via error messages)?
- HTTP Compression
- Detailed error messages visible to remote clients (should use custom error pages instead) (Correct answer)
- Failed Request Tracing logs stored locally
- Windows Authentication
Correct answer: Detailed error messages visible to remote clients (should use custom error pages instead)
DISA STIG V-76681 requires that IIS serve custom error pages to remote clients rather than detailed error messages that could reveal server internals to attackers.
Question 5: For ISO 27001 Annex A control A.12.6.1 (management of technical vulnerabilities), which IIS-related practice is most directly applicable?
- Delaying IIS and Windows Server patches indefinitely to ensure stability
- Establishing a patch management process to apply IIS security updates within defined timeframes (Correct answer)
- Disabling Windows Update on all IIS servers
- Applying patches only when a breach occurs
Correct answer: Establishing a patch management process to apply IIS security updates within defined timeframes
ISO 27001 A.12.6.1 requires organizations to identify and manage technical vulnerabilities in a timely manner, which directly requires a defined IIS patching and vulnerability remediation process.
Question 6: Which IIS application pool identity setting aligns with the principle of least privilege required by NIST 800-53 AC-6?
- Running application pools as LocalSystem (highest privilege)
- Running application pools as ApplicationPoolIdentity or a dedicated low-privilege service account (Correct answer)
- Using a Domain Administrator account for all application pools
- Sharing a single high-privilege account across all application pools
Correct answer: Running application pools as ApplicationPoolIdentity or a dedicated low-privilege service account
NIST 800-53 AC-6 (Least Privilege) requires that processes operate with only the permissions needed; ApplicationPoolIdentity or a dedicated low-privilege account minimizes potential damage from a compromised pool.
Question 7: A healthcare organization's IIS server must comply with HIPAA's Minimum Necessary standard for audit logs. Which approach best satisfies this?
- Logging every byte of every request and response including full POST bodies
- Logging access metadata (timestamp, IP, URI, status) without capturing full request bodies containing PHI (Correct answer)
- Not logging any activity to prevent PHI exposure in logs
- Storing raw logs in a public S3 bucket for easy access
Correct answer: Logging access metadata (timestamp, IP, URI, status) without capturing full request bodies containing PHI
HIPAA's Minimum Necessary standard requires collecting only the information needed; logging access metadata satisfies audit requirements without unnecessarily capturing PHI in request bodies.
Microsoft Internet Information Server Regulatory Frameworks & Compliance 4
Which IIS configuration change is required to comply with PCI DSS Requirement 2.2.1 (one primary function per server)?