Microsoft Internet Information Server Risk Assessment & Management 3 — Questions and Answers
Question 1: In IIS, which risk is introduced when application pool identity is set to LocalSystem?
- The site cannot access the network
- A compromised app gains full OS-level privileges (Correct answer)
- SSL certificates cannot be bound
- Logging is automatically disabled
Correct answer: A compromised app gains full OS-level privileges
LocalSystem has unrestricted access to the local machine; a compromise under this identity gives attackers complete control of the server.
Question 2: Which TLS configuration risk is present when IIS still supports SSL 3.0 or TLS 1.0?
- Increased server memory usage
- Vulnerability to POODLE and BEAST downgrade attacks (Correct answer)
- Certificate binding failures
- Slow handshake performance only
Correct answer: Vulnerability to POODLE and BEAST downgrade attacks
SSL 3.0 is vulnerable to POODLE and TLS 1.0 is susceptible to BEAST; both protocols should be disabled in IIS via the Windows registry.
Question 3: What risk does enabling HTTP/2 without proper input validation present in IIS?
- Slower page load times
- HTTP/2 CONTINUATION frame flooding leading to DoS (Correct answer)
- Broken certificate chains
- Loss of URL rewrite rules
Correct answer: HTTP/2 CONTINUATION frame flooding leading to DoS
HTTP/2 CONTINUATION frame flooding (CVE-2024-27316) can exhaust server memory and cause denial of service if not properly controlled.
Question 4: From a risk management standpoint, why should IIS administrators restrict which HTTP verbs are allowed via Request Filtering?
- To improve compression ratios
- To prevent exploitation of dangerous methods like PUT and DELETE (Correct answer)
- To enable WebSocket connections
- To allow CORS preflight requests
Correct answer: To prevent exploitation of dangerous methods like PUT and DELETE
Allowing unsafe verbs like PUT, DELETE, and TRACE can enable file upload attacks and server fingerprinting if not explicitly needed.
Question 5: Which IIS configuration error creates a risk of path disclosure in error messages?
- Enabling custom error pages set to DetailedLocalOnly
- Leaving custom errors in Detailed mode for all users (Correct answer)
- Enabling HTTP compression
- Disabling static content caching
Correct answer: Leaving custom errors in Detailed mode for all users
Detailed error mode exposes full physical file paths and stack traces to remote users, which aids attacker reconnaissance.
Question 6: An IIS risk assessment identifies that wildcard script maps are configured. What threat does this create?
- All requests are logged twice
- Every file extension is processed by an ISAPI handler, enabling script execution of non-script files (Correct answer)
- Static files are cached too aggressively
- HTTP keep-alive is disabled automatically
Correct answer: Every file extension is processed by an ISAPI handler, enabling script execution of non-script files
Wildcard script maps cause IIS to pass all requests—including static files—through a handler, potentially executing malicious payloads uploaded as images or documents.
Question 7: What is the primary security risk of enabling parent path access (..) in IIS Classic ASP settings?
- Slower ASP compilation
- Directory traversal allowing access to files outside the web root (Correct answer)
- Broken session cookies
- Disabling output caching
Correct answer: Directory traversal allowing access to files outside the web root
Enabling parent paths lets ASP code navigate above the web root using ../ sequences, potentially exposing sensitive server files.
Microsoft Internet Information Server Risk Assessment & Management 3
In IIS, which risk is introduced when application pool identity is set to LocalSystem?