Microsoft Internet Information Server Risk Assessment & Management 3

Question 1

In IIS, which risk is introduced when application pool identity is set to LocalSystem?

Accepted Answer

A compromised app gains full OS-level privileges

Answer

LocalSystem has unrestricted access to the local machine; a compromise under this identity gives attackers complete control of the server.

Question 2

Which TLS configuration risk is present when IIS still supports SSL 3.0 or TLS 1.0?

Accepted Answer

Vulnerability to POODLE and BEAST downgrade attacks

Answer

SSL 3.0 is vulnerable to POODLE and TLS 1.0 is susceptible to BEAST; both protocols should be disabled in IIS via the Windows registry.

Question 3

What risk does enabling HTTP/2 without proper input validation present in IIS?

Accepted Answer

HTTP/2 CONTINUATION frame flooding leading to DoS

Answer

HTTP/2 CONTINUATION frame flooding (CVE-2024-27316) can exhaust server memory and cause denial of service if not properly controlled.

Question 4

From a risk management standpoint, why should IIS administrators restrict which HTTP verbs are allowed via Request Filtering?

Accepted Answer

To prevent exploitation of dangerous methods like PUT and DELETE

Answer

Allowing unsafe verbs like PUT, DELETE, and TRACE can enable file upload attacks and server fingerprinting if not explicitly needed.

Question 5

Which IIS configuration error creates a risk of path disclosure in error messages?

Accepted Answer

Leaving custom errors in Detailed mode for all users

Answer

Detailed error mode exposes full physical file paths and stack traces to remote users, which aids attacker reconnaissance.

Microsoft Internet Information Server Practice Test