Microsoft Internet Information Server Risk Assessment & Management 4 — Questions and Answers
Question 1: Which IIS health and diagnostics feature helps quantify availability risk by tracking worker process crashes over time?
- HTTP Logging
- Worker Process Rapid-Fail Protection (Correct answer)
- Output Caching
- URL Authorization
Correct answer: Worker Process Rapid-Fail Protection
Rapid-Fail Protection tracks process crashes and stops the application pool after a threshold, providing measurable data for availability risk analysis.
Question 2: A penetration tester discovers that IIS returns HTTP 200 for non-existent URLs due to a misconfiguration. Which risk does this represent?
- Increased CPU usage from processing extra requests
- Soft 404 masking errors, aiding attacker enumeration of valid paths (Correct answer)
- Broken URL rewrite rules
- SSL certificate mismatch errors
Correct answer: Soft 404 masking errors, aiding attacker enumeration of valid paths
Returning 200 for missing resources (soft 404) prevents proper error detection and allows attackers to enumerate site structure without triggering alert thresholds.
Question 3: In IIS, which security control reduces the risk of clickjacking attacks on hosted web applications?
- Enabling HSTS
- Adding X-Frame-Options response header via HTTP Response Headers (Correct answer)
- Disabling keep-alive connections
- Configuring IP address restrictions
Correct answer: Adding X-Frame-Options response header via HTTP Response Headers
The X-Frame-Options header prevents the site from being embedded in iframes on other domains, blocking clickjacking attempts.
Question 4: Which IIS feature allows administrators to throttle request rates to reduce DoS risk from a single IP?
- Output Caching
- Dynamic IP Restrictions (Correct answer)
- Failed Request Tracing
- HTTP Compression
Correct answer: Dynamic IP Restrictions
Dynamic IP Restrictions can automatically block or throttle IP addresses that exceed a configured request rate, mitigating volumetric DoS attacks.
Question 5: When assessing IIS risk in a shared hosting environment, which isolation mechanism is most critical for preventing cross-site contamination?
- Shared application pool for all sites
- Separate application pools per site with unique identities (Correct answer)
- A single SSL certificate for all sites
- Enabling directory browsing for all sites
Correct answer: Separate application pools per site with unique identities
Assigning each site its own application pool with a unique identity ensures that a compromise of one site cannot access another site's files or memory.
Question 6: Which certificate management risk is introduced when IIS uses a self-signed certificate in a production environment?
- Better performance due to no CA overhead
- Users receive browser warnings and traffic is susceptible to MITM attacks (Correct answer)
- Automatic certificate renewal failures
- HTTP/2 is automatically disabled
Correct answer: Users receive browser warnings and traffic is susceptible to MITM attacks
Self-signed certificates are not trusted by browsers, warn users, and provide no protection against man-in-the-middle attacks since there is no CA validation chain.
Question 7: What risk does keeping IIS's default 'iisstart.htm' and sample files in place introduce?
- Increased disk I/O
- Version fingerprinting and exposure of known default content attackers can target (Correct answer)
- Broken URL routing for the root application
- Automatic disabling of custom 404 pages
Correct answer: Version fingerprinting and exposure of known default content attackers can target
Default IIS pages confirm the server type and version to attackers, and sample applications may contain known vulnerabilities.
Microsoft Internet Information Server Risk Assessment & Management 4
Which IIS health and diagnostics feature helps quantify availability risk by tracking worker process crashes over time?