Microsoft Internet Information Server Risk Assessment & Management 4

Question 1

Which IIS health and diagnostics feature helps quantify availability risk by tracking worker process crashes over time?

Accepted Answer

Worker Process Rapid-Fail Protection

Answer

Rapid-Fail Protection tracks process crashes and stops the application pool after a threshold, providing measurable data for availability risk analysis.

Question 2

A penetration tester discovers that IIS returns HTTP 200 for non-existent URLs due to a misconfiguration. Which risk does this represent?

Accepted Answer

Soft 404 masking errors, aiding attacker enumeration of valid paths

Answer

Returning 200 for missing resources (soft 404) prevents proper error detection and allows attackers to enumerate site structure without triggering alert thresholds.

Question 3

In IIS, which security control reduces the risk of clickjacking attacks on hosted web applications?

Accepted Answer

Adding X-Frame-Options response header via HTTP Response Headers

Answer

The X-Frame-Options header prevents the site from being embedded in iframes on other domains, blocking clickjacking attempts.

Question 4

Which IIS feature allows administrators to throttle request rates to reduce DoS risk from a single IP?

Accepted Answer

Dynamic IP Restrictions

Answer

Dynamic IP Restrictions can automatically block or throttle IP addresses that exceed a configured request rate, mitigating volumetric DoS attacks.

Question 5

When assessing IIS risk in a shared hosting environment, which isolation mechanism is most critical for preventing cross-site contamination?

Accepted Answer

Separate application pools per site with unique identities

Answer

Assigning each site its own application pool with a unique identity ensures that a compromise of one site cannot access another site's files or memory.

Microsoft Internet Information Server Practice Test

Microsoft Internet Information Server Practice Test

Microsoft Internet Information Server Risk Assessment & Management 4