Microsoft Internet Information Server Regulatory Frameworks & Compliance 4

Question 1

Which IIS configuration change is required to comply with PCI DSS Requirement 2.2.1 (one primary function per server)?

Accepted Answer

Separating web, database, and application server roles onto dedicated servers or using strict isolation

Answer

PCI DSS Requirement 2.2.1 mandates that servers implement only one primary function to prevent different security levels from co-existing on the same system.

Question 2

FISMA requires continuous monitoring of federal information systems. Which IIS tool integrates best with SIEM solutions for this purpose?

Accepted Answer

Windows Event Forwarding (WEF) to stream IIS and Windows Security event logs to a SIEM

Answer

Windows Event Forwarding enables real-time streaming of IIS and security events to centralized SIEM platforms, satisfying FISMA's continuous monitoring requirements.

Question 3

An IIS server handling credit card data must comply with PCI DSS Requirement 8.3 (MFA for non-console administrative access). Which implementation satisfies this?

Accepted Answer

Requiring multi-factor authentication for RDP and IIS Manager remote access to the cardholder data environment

Answer

PCI DSS Requirement 8.3 mandates MFA for all non-console administrative access into the cardholder data environment, including RDP sessions to IIS servers.

Question 4

Which IIS feature should be disabled to comply with DISA STIG V-76681 (preventing information disclosure via error messages)?

Accepted Answer

Detailed error messages visible to remote clients (should use custom error pages instead)

Answer

DISA STIG V-76681 requires that IIS serve custom error pages to remote clients rather than detailed error messages that could reveal server internals to attackers.

Question 5

For ISO 27001 Annex A control A.12.6.1 (management of technical vulnerabilities), which IIS-related practice is most directly applicable?

Accepted Answer

Establishing a patch management process to apply IIS security updates within defined timeframes

Answer

ISO 27001 A.12.6.1 requires organizations to identify and manage technical vulnerabilities in a timely manner, which directly requires a defined IIS patching and vulnerability remediation process.

Microsoft Internet Information Server Practice Test

Microsoft Internet Information Server Practice Test

Microsoft Internet Information Server Regulatory Frameworks & Compliance 4