Microsoft Internet Information Server Regulatory Frameworks & Compliance 5

Question 1

Which TLS protocol version must be disabled on IIS to comply with PCI DSS v4.0 Requirement 4.2.1, which prohibits 'weak cryptography'?

Accepted Answer

TLS 1.0 and SSL 3.0

Answer

PCI DSS v4.0 explicitly prohibits SSL and early TLS (TLS 1.0); these must be disabled on IIS, with TLS 1.2 or higher required for cardholder data transmissions.

Question 2

Under CCPA (California Consumer Privacy Act), if an IIS access log contains California residents' IP addresses, the organization must:

Accepted Answer

Treat IP addresses as personal information subject to CCPA rights, including consumer requests for deletion

Answer

CCPA defines IP addresses as personal information when linked or reasonably linkable to a California consumer; organizations must honor deletion requests and disclose collection in privacy notices.

Question 3

DISA STIG requires removing the IIS default documents (default.htm, iisstart.htm, etc.) in certain configurations. What compliance risk does leaving them exposed create?

Accepted Answer

They may reveal server version, structure, or default credentials to reconnaissance attackers

Answer

Default IIS pages can disclose server version information and signal to attackers that the server is running default configurations, making it easier to identify and exploit known vulnerabilities.

Question 4

For a FedRAMP Moderate baseline, which IIS SC-8 (Transmission Confidentiality and Integrity) control implementation is required?

Accepted Answer

Cryptographic mechanisms (HTTPS with TLS 1.2+) must protect all transmitted information

Answer

FedRAMP Moderate requires implementing NIST 800-53 SC-8, which mandates cryptographic protection of data in transit; IIS must use HTTPS with TLS 1.2 or higher for all transmissions.

Question 5

Which IIS response header, when missing, causes a finding in most web security compliance scans (OWASP, PCI ASV scans)?

Accepted Answer

Strict-Transport-Security (HSTS)

Answer

The HTTP Strict-Transport-Security (HSTS) header instructs browsers to only connect via HTTPS; its absence is flagged by PCI Approved Scanning Vendors and OWASP security audits as a gap.

Microsoft Internet Information Server Practice Test

Microsoft Internet Information Server Practice Test

Microsoft Internet Information Server Regulatory Frameworks & Compliance 5