Microsoft Internet Information Server Research & Evidence-Based Practice 4 — Questions and Answers
Question 1: Which evidence-based methodology does Microsoft recommend for capacity planning IIS deployments: measuring at what CPU utilization threshold to add servers?
- 50%
- 70–75% (Correct answer)
- 90%
- 100%
Correct answer: 70–75%
Microsoft's IIS capacity planning guidance recommends maintaining average CPU at 70–75% to leave headroom for traffic spikes without degrading response times.
Question 2: A researcher wants to test whether IIS compression is actually reducing payload sizes. Which metric in IIS logs provides direct evidence?
- cs-bytes and sc-bytes fields compared across compressed vs uncompressed endpoints (Correct answer)
- time-taken field only
- sc-status field
- cs-host field
Correct answer: cs-bytes and sc-bytes fields compared across compressed vs uncompressed endpoints
Comparing cs-bytes (bytes sent by client) and sc-bytes (bytes sent by server) before and after enabling compression quantifies the actual savings.
Question 3: Which configuration file is the authoritative source of evidence for site-level IIS settings and should be reviewed during a configuration audit?
- web.config in the site root
- applicationHost.config (Correct answer)
- machine.config
- httpd.conf
Correct answer: applicationHost.config
applicationHost.config (in %windir%\System32\inetsrv\config) is the master IIS configuration file containing all site, application pool, and server-level settings.
Question 4: When researching IIS DDoS resilience, which built-in IIS feature provides evidence-based rate limiting by restricting requests per connection per time period?
- Request Filtering
- Dynamic IP Restrictions (DIPR) (Correct answer)
- URL Rewrite
- Output Caching
Correct answer: Dynamic IP Restrictions (DIPR)
Dynamic IP Restrictions can automatically detect and deny IPs that exceed a configured request rate threshold, providing a built-in DDoS mitigation layer.
Question 5: A researcher needs to reproduce a production IIS configuration in a test lab for evidence-based change testing. Which approach preserves the complete configuration?
- Export only web.config files
- Copy applicationHost.config and use appcmd export (Correct answer)
- Screenshot IIS Manager panels
- Export Windows Registry HKLM\SOFTWARE\Microsoft\InetStp
Correct answer: Copy applicationHost.config and use appcmd export
Using appcmd to export configurations alongside applicationHost.config captures all server-level settings, sites, app pools, and bindings for accurate reproduction.
Question 6: Which HTTP response header, when researched and added to IIS, provides evidence-based protection against MIME-type sniffing attacks?
- Strict-Transport-Security
- X-Content-Type-Options: nosniff (Correct answer)
- X-Frame-Options: DENY
- Content-Security-Policy
Correct answer: X-Content-Type-Options: nosniff
X-Content-Type-Options: nosniff instructs browsers not to guess content types and instead honor the declared Content-Type, preventing MIME confusion attacks.
Question 7: A performance researcher finds that IIS kernel-mode caching is not caching authenticated requests. What is the evidence-based explanation for this behavior?
- Kernel caching requires .NET Framework 4.8
- Kernel-mode caching does not cache responses to requests requiring authentication by design (Correct answer)
- The file must be over 256 KB to be cached
- Dynamic compression must be disabled first
Correct answer: Kernel-mode caching does not cache responses to requests requiring authentication by design
By design, IIS kernel-mode cache (HTTP.sys) skips caching for requests that require authentication because cached responses cannot be personalized per user.
Microsoft Internet Information Server Research & Evidence-Based Practice 4
Which evidence-based methodology does Microsoft recommend for capacity planning IIS deployments: measuring at what CPU utilization threshold to add servers?