Microsoft Internet Information Server Research & Evidence-Based Practice 2 — Questions and Answers
Question 1: Which IIS log file format includes the most fields by default and is recommended for detailed forensic analysis?
- NCSA Common Log Format
- W3C Extended Log Format (Correct answer)
- IIS Log Format
- ODBC Logging
Correct answer: W3C Extended Log Format
W3C Extended Log Format is the IIS default and offers selectable fields including cs-uri-stem, sc-status, time-taken, and more, making it best for forensic research.
Question 2: A researcher wants to identify slow page load trends over 30 days using IIS logs. Which field should they primarily analyze?
- cs-method
- sc-status
- time-taken (Correct answer)
- cs-bytes
Correct answer: time-taken
The time-taken field records milliseconds to serve each request, making it the key metric for identifying slow-loading resources over time.
Question 3: Which built-in Windows tool can be used to benchmark IIS throughput by simulating multiple concurrent HTTP requests?
- Performance Monitor
- WCAT (Web Capacity Analysis Tool) (Correct answer)
- Netstat
- IIS Manager
Correct answer: WCAT (Web Capacity Analysis Tool)
WCAT is Microsoft's purpose-built HTTP load-testing utility that simulates concurrent clients against IIS to gather evidence-based capacity data.
Question 4: When analyzing IIS Failed Request Tracing logs to diagnose a 500 error, what key piece of evidence does the trace provide that standard logs do not?
- Client IP address
- The exact module and notification where the failure occurred (Correct answer)
- SSL certificate details
- The HTTP verb used
Correct answer: The exact module and notification where the failure occurred
Failed Request Tracing captures the full IIS pipeline path and identifies the specific module and event that triggered the failure, far beyond what status codes reveal.
Question 5: Which Performance Monitor counter should a researcher use as primary evidence that IIS worker processes are under memory pressure?
- Web Service\Current Connections
- W3SVC_W3WP\Active Requests
- Process(w3wp)\Private Bytes (Correct answer)
- TCPv4\Connections Established
Correct answer: Process(w3wp)\Private Bytes
Private Bytes for the w3wp process tracks memory exclusively held by the worker process, providing direct evidence of memory growth or leaks.
Question 6: A security researcher discovers repeated 401 status codes from a single IP in IIS logs. What evidence-based action is most appropriate as a first step?
- Immediately block the IP in Windows Firewall
- Correlate the IP against IP Reputation databases and review the User-Agent field (Correct answer)
- Disable anonymous authentication
- Recycle the application pool
Correct answer: Correlate the IP against IP Reputation databases and review the User-Agent field
Cross-referencing the IP with reputation data and examining the User-Agent provides evidence to distinguish between a brute-force attack and a misconfigured legitimate client before taking action.
Question 7: Which IIS diagnostic feature generates ETW (Event Tracing for Windows) events that researchers can capture with tools like WPA to trace performance bottlenecks?
- HTTP.sys trace provider (Correct answer)
- IIS Manager logging
- Request Filtering logs
- Application Event Log
Correct answer: HTTP.sys trace provider
HTTP.sys exposes ETW trace providers that capture kernel-level HTTP request events, enabling detailed performance research using Windows Performance Analyzer.
Microsoft Internet Information Server Research & Evidence-Based Practice 2
Which IIS log file format includes the most fields by default and is recommended for detailed forensic analysis?