Microsoft Internet Information Server Research & Evidence-Based Practice 3 — Questions and Answers
Question 1: Which Microsoft documentation source provides the definitive, evidence-based list of IIS HTTP status code subcodes (e.g., 404.1, 404.2)?
- RFC 7231
- Microsoft Support Article KB943891 (Correct answer)
- OWASP Testing Guide
- IIS Manager Help panel
Correct answer: Microsoft Support Article KB943891
KB943891 on the Microsoft Support site is the authoritative reference listing IIS-specific HTTP status subcodes and their meanings for troubleshooting.
Question 2: A researcher comparing IIS application pool recycling events wants to correlate them with application errors. Which Windows log should they query?
- Security Event Log
- System Event Log
- Application Event Log under source 'WAS' (Correct answer)
- IIS W3C log
Correct answer: Application Event Log under source 'WAS'
Windows Activation Service (WAS) writes application pool lifecycle events including recycles to the Application Event Log, providing a timeline for correlation.
Question 3: Which PowerShell module provides cmdlets that allow researchers to programmatically query and export IIS configuration as evidence of current state?
- NetAdapter
- WebAdministration (Correct answer)
- ServerManager
- PSDesiredStateConfiguration
Correct answer: WebAdministration
The WebAdministration module exposes the IIS configuration hierarchy through cmdlets like Get-WebSite and Get-WebConfiguration, enabling scripted auditing.
Question 4: When researching TLS configuration hardening for IIS, which registry hive path is the evidence-based location where SSL/TLS protocol version support is controlled?
- HKLM\SYSTEM\CurrentControlSet\Services\HTTP
- HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols (Correct answer)
- HKLM\SOFTWARE\Microsoft\InetStp
- HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Correct answer: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
The SCHANNEL\Protocols registry path is where administrators enable or disable specific TLS/SSL versions on Windows Server, including for IIS.
Question 5: A research team needs to verify that an IIS server's response headers do not leak version information. Which tool provides the most direct evidence by capturing raw HTTP headers?
- IIS Manager
- Fiddler or curl --head (Correct answer)
- Windows Event Viewer
- Task Manager
Correct answer: Fiddler or curl --head
Tools like Fiddler or curl --head capture the raw HTTP response headers sent by the server, providing direct evidence of what version information is exposed.
Question 6: Which IIS feature log should a researcher enable to gather evidence about which URL rewrite rules are matching (or failing) for incoming requests?
- Failed Request Tracing with URL Rewrite conditions (Correct answer)
- W3C logging with cs-uri-stem
- HTTP.sys error log
- Windows Firewall log
Correct answer: Failed Request Tracing with URL Rewrite conditions
Failed Request Tracing can be configured to trace URL Rewrite module events, showing each rule evaluation and whether conditions matched or failed.
Question 7: A best-practice researcher recommends setting maxAllowedContentLength in IIS Request Filtering. What is the default value in bytes on a standard IIS installation?
- 10,485,760 (10 MB)
- 30,000,000 (approx. 28.6 MB) (Correct answer)
- 52,428,800 (50 MB)
- 1,073,741,824 (1 GB)
Correct answer: 30,000,000 (approx. 28.6 MB)
The default maxAllowedContentLength is 30,000,000 bytes (approximately 28.6 MB) as defined in the IIS Request Filtering defaults.
Microsoft Internet Information Server Research & Evidence-Based Practice 3
Which Microsoft documentation source provides the definitive, evidence-based list of IIS HTTP status code subcodes (e.g., 404.1, 404.2)?