Microsoft Internet Information Server Research & Evidence-Based Practice 5 — Questions and Answers
Question 1: A researcher studying IIS application pool isolation wants evidence of memory separation between two sites. Which process tool verifies they run in separate w3wp.exe instances?
- IIS Manager bindings view
- Task Manager or Process Explorer showing separate w3wp PIDs per pool (Correct answer)
- Windows Firewall rules
- Performance Monitor ASP.NET counters
Correct answer: Task Manager or Process Explorer showing separate w3wp PIDs per pool
Task Manager or Sysinternals Process Explorer shows distinct w3wp.exe process IDs for each application pool, confirming true process-level isolation.
Question 2: Which evidence-based practice should be followed before applying a CIS Benchmark hardening script to an IIS production server?
- Run the script at peak traffic for real-world validation
- Test in a staging environment and review each setting against the application's requirements (Correct answer)
- Apply directly and roll back if errors occur
- Notify users and apply without testing
Correct answer: Test in a staging environment and review each setting against the application's requirements
CIS Benchmarks include settings that may break application functionality; staging validation against application-specific requirements prevents unplanned outages.
Question 3: Which IIS log analysis tool, free from Microsoft, can parse W3C logs and produce visual evidence of request distribution, error rates, and top URLs?
- Log Parser 2.2 with Log Parser Studio (Correct answer)
- Windows Event Viewer
- Performance Monitor
- Procmon
Correct answer: Log Parser 2.2 with Log Parser Studio
Microsoft Log Parser 2.2 with the Log Parser Studio GUI allows SQL-like queries against W3C log files and generates charts as visual evidence for analysis.
Question 4: When researching IIS handler mapping security, which approach provides evidence that unnecessary handlers (like .asp legacy) are disabled?
- Run netstat -an and look for open ports
- Query IIS handler mappings via appcmd list config /section:handlers and audit the list (Correct answer)
- Check Windows Update history
- Review NTFS permissions on wwwroot
Correct answer: Query IIS handler mappings via appcmd list config /section:handlers and audit the list
Using appcmd to list configured handlers outputs the complete handler mapping table, providing documented evidence for the security audit trail.
Question 5: A researcher is validating that IIS output caching is effective. Which Performance Monitor counter provides the most direct evidence of cache hit rate?
- ASP.NET\Requests Queued
- Web Service Cache\Kernel: URI Cache Hits % (Correct answer)
- Process(w3wp)\% Processor Time
- TCPv4\Segments Retransmitted/sec
Correct answer: Web Service Cache\Kernel: URI Cache Hits %
The 'Kernel: URI Cache Hits %' counter in the Web Service Cache object reports the percentage of requests served from HTTP.sys kernel cache versus hitting the worker process.
Question 6: Which evidence-based approach should a researcher use to determine the optimal IIS application pool queue length for a specific workload?
- Set queue length to unlimited and monitor indefinitely
- Use load testing (e.g., WCAT or JMeter) to identify the request rate where 503 errors begin, then set queue length just above that baseline (Correct answer)
- Set it to the IIS default of 1000 and never change it
- Match queue length to the number of CPU cores
Correct answer: Use load testing (e.g., WCAT or JMeter) to identify the request rate where 503 errors begin, then set queue length just above that baseline
Load testing to find the saturation point then setting the queue length slightly above the normal peak provides an evidence-based value that prevents false 503s while protecting against runaway queuing.
Question 7: A security researcher verifies IIS SSL/TLS cipher suite hardening. Which Windows tool provides authoritative evidence of the currently negotiated cipher during a live HTTPS session?
- IIS Manager SSL Settings page
- Wireshark capturing the TLS ClientHello/ServerHello handshake (Correct answer)
- Windows Certificate Manager (certmgr.msc)
- IIS W3C log sc-status field
Correct answer: Wireshark capturing the TLS ClientHello/ServerHello handshake
Wireshark captures the TLS handshake packets, showing the exact cipher suite negotiated in the ServerHello message, providing incontrovertible evidence of what is actually in use.
Microsoft Internet Information Server Research & Evidence-Based Practice 5
A researcher studying IIS application pool isolation wants evidence of memory separation between two sites.
Which process tool verifies they run in separate w3wp.exe instances?