Microsoft Internet Information Server Risk Assessment & Management 2 — Questions and Answers
Question 1: Which IIS feature should be disabled to reduce the attack surface related to directory traversal risks?
- Dynamic IP Restrictions
- Directory Browsing (Correct answer)
- Request Filtering
- URL Rewrite
Correct answer: Directory Browsing
Directory Browsing exposes the file system structure to attackers; disabling it is a core hardening step to reduce directory traversal risk.
Question 2: What is the purpose of enabling Failed Request Tracing (FREB) in IIS from a risk management perspective?
- Blocking malicious requests automatically
- Diagnosing and documenting error conditions for risk analysis (Correct answer)
- Encrypting failed requests
- Redirecting failed requests to a safe page
Correct answer: Diagnosing and documenting error conditions for risk analysis
FREB captures detailed diagnostics for failed requests, helping administrators identify vulnerabilities and assess risk patterns.
Question 3: An IIS server is exposed to a Slowloris denial-of-service attack. Which setting in Request Filtering best mitigates this risk?
- Maximum URL length
- Maximum allowed content length
- Request timeout settings via connectionTimeout (Correct answer)
- HTTP verb filtering
Correct answer: Request timeout settings via connectionTimeout
Lowering connectionTimeout forces slow or idle connections to drop, mitigating Slowloris-style attacks that hold connections open.
Question 4: Which built-in IIS authentication method poses the highest risk of credential exposure over unencrypted connections?
- Windows Authentication (Kerberos)
- Basic Authentication (Correct answer)
- Digest Authentication
- Anonymous Authentication
Correct answer: Basic Authentication
Basic Authentication transmits credentials as Base64-encoded plaintext, making interception trivial without TLS encryption.
Question 5: When performing a risk assessment on IIS, which log field is most critical for detecting IP-based brute force attacks?
- cs-uri-stem
- c-ip (Correct answer)
- sc-status
- cs-bytes
Correct answer: c-ip
The c-ip field records the client IP address, enabling analysts to identify repeated failed authentication attempts from the same source.
Question 6: A risk audit finds that IIS is serving responses with Server and X-Powered-By headers exposed. What risk does this introduce?
- Increased bandwidth consumption
- Information disclosure enabling targeted attacks (Correct answer)
- Session fixation vulnerability
- Cross-site request forgery
Correct answer: Information disclosure enabling targeted attacks
Exposing server version headers gives attackers precise version information to identify and exploit known CVEs.
Question 7: Which IIS module should be removed to mitigate risks associated with WebDAV-based attacks?
- URL Rewrite Module
- WebDAV Publishing Module (Correct answer)
- HTTP Redirection Module
- IP Address Restrictions Module
Correct answer: WebDAV Publishing Module
WebDAV introduces file manipulation capabilities over HTTP; removing the WebDAV Publishing Module eliminates this attack vector if not required.
Microsoft Internet Information Server Risk Assessment & Management 2
Which IIS feature should be disabled to reduce the attack surface related to directory traversal risks?