Microsoft Internet Information Server Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: Which TLS protocol version must be disabled on IIS to comply with PCI DSS v4.0 Requirement 4.2.1, which prohibits 'weak cryptography'?
- TLS 1.3
- TLS 1.2
- TLS 1.0 and SSL 3.0 (Correct answer)
- DTLS 1.2
Correct answer: TLS 1.0 and SSL 3.0
PCI DSS v4.0 explicitly prohibits SSL and early TLS (TLS 1.0); these must be disabled on IIS, with TLS 1.2 or higher required for cardholder data transmissions.
Question 2: Under CCPA (California Consumer Privacy Act), if an IIS access log contains California residents' IP addresses, the organization must:
- Publish all IP addresses in the annual transparency report
- Treat IP addresses as personal information subject to CCPA rights, including consumer requests for deletion (Correct answer)
- Share IP logs with any requesting third party to support open data principles
- Retain IP addresses indefinitely as they are not personal information under CCPA
Correct answer: Treat IP addresses as personal information subject to CCPA rights, including consumer requests for deletion
CCPA defines IP addresses as personal information when linked or reasonably linkable to a California consumer; organizations must honor deletion requests and disclose collection in privacy notices.
Question 3: DISA STIG requires removing the IIS default documents (default.htm, iisstart.htm, etc.) in certain configurations. What compliance risk does leaving them exposed create?
- They cause SSL certificate errors
- They may reveal server version, structure, or default credentials to reconnaissance attackers (Correct answer)
- They prevent Windows Authentication from functioning
- They block HTTP compression from working
Correct answer: They may reveal server version, structure, or default credentials to reconnaissance attackers
Default IIS pages can disclose server version information and signal to attackers that the server is running default configurations, making it easier to identify and exploit known vulnerabilities.
Question 4: For a FedRAMP Moderate baseline, which IIS SC-8 (Transmission Confidentiality and Integrity) control implementation is required?
- Plaintext HTTP is acceptable for all internal endpoints
- Cryptographic mechanisms (HTTPS with TLS 1.2+) must protect all transmitted information (Correct answer)
- Email encryption replaces the need for HTTPS on web interfaces
- SC-8 only applies to database connections, not web servers
Correct answer: Cryptographic mechanisms (HTTPS with TLS 1.2+) must protect all transmitted information
FedRAMP Moderate requires implementing NIST 800-53 SC-8, which mandates cryptographic protection of data in transit; IIS must use HTTPS with TLS 1.2 or higher for all transmissions.
Question 5: Which IIS response header, when missing, causes a finding in most web security compliance scans (OWASP, PCI ASV scans)?
- X-Requested-With
- Strict-Transport-Security (HSTS) (Correct answer)
- X-Forwarded-For
- Accept-Ranges
Correct answer: Strict-Transport-Security (HSTS)
The HTTP Strict-Transport-Security (HSTS) header instructs browsers to only connect via HTTPS; its absence is flagged by PCI Approved Scanning Vendors and OWASP security audits as a gap.
Question 6: An IIS server subject to GLBA (Gramm-Leach-Bliley Act) Safeguards Rule must implement which access control practice for administrative interfaces?
- Allow all bank employees unrestricted IIS Manager access from any location
- Implement role-based access controls limiting IIS administrative access to authorized personnel only, with activity logging (Correct answer)
- Use a single shared admin password stored in a text file on the web root
- Disable all authentication on the IIS management interface for efficiency
Correct answer: Implement role-based access controls limiting IIS administrative access to authorized personnel only, with activity logging
GLBA's Safeguards Rule requires financial institutions to implement access controls limiting system access to authorized users; IIS administrative access must be role-based with audit logging.
Question 7: Which approach to IIS SSL certificate management is required by compliance frameworks to prevent service disruptions that could indicate a lapse in security controls?
- Using self-signed certificates for all production HTTPS endpoints
- Implementing certificate lifecycle management with alerts for expiration at least 30 days in advance (Correct answer)
- Allowing certificates to expire and renewing only after users report browser errors
- Using wildcard certificates with 10-year validity and no renewal tracking
Correct answer: Implementing certificate lifecycle management with alerts for expiration at least 30 days in advance
Compliance frameworks including PCI DSS and SOC 2 expect organizations to manage certificate lifecycles proactively, with expiration monitoring and renewal processes to prevent unencrypted service gaps.
Microsoft Internet Information Server Regulatory Frameworks & Compliance 5
Which TLS protocol version must be disabled on IIS to comply with PCI DSS v4.0 Requirement 4.2.1, which prohibits 'weak cryptography'?