Microsoft Internet Information Server Risk Assessment & Management 5

Question 1

Which approach best manages the risk of unpatched IIS vulnerabilities in a production environment?

Accepted Answer

Implementing a patch management policy with regular Windows Update cycles

Answer

Disabling Windows Update to avoid compatibility issues

Answer

Running IIS on an isolated network with no internet access only

Answer

Enabling all IIS modules to ensure compatibility with future patches

Question 2

An IIS site accepts file uploads. Which Request Filtering setting directly reduces the risk of large-payload attacks?

Accepted Answer

maxAllowedContentLength

Answer

maxQueryString

Answer

maxUrl

Answer

requestLimits headerLimits

Question 3

From a risk management perspective, why should IIS administrators enable HTTP Strict Transport Security (HSTS)?

Accepted Answer

To prevent protocol downgrade attacks by forcing browsers to use HTTPS

Answer

To cache static content longer on CDNs

Answer

To compress HTTP responses more efficiently

Answer

To block direct IP access to the server

Question 4

Which IIS auditing configuration helps satisfy the risk documentation requirements of compliance frameworks like PCI-DSS?

Accepted Answer

Configuring centralized W3C logging with sufficient fields retained for 90+ days

Answer

Enabling directory browsing for audit access

Answer

Disabling error logging to reduce noise

Answer

Using only Windows Event Log without W3C logs

Question 5

What risk is introduced when IIS application pools are configured with an excessively long idle timeout?

Accepted Answer

Memory leaks accumulate longer, increasing crash risk and potential resource exhaustion

Answer

Applications restart too frequently

Answer

SSL certificates expire faster

Answer

Request queuing is disabled automatically

Question 6

Which IIS configuration mitigates the risk of MIME-type sniffing attacks where browsers execute content as a different type than intended?

Accepted Answer

Adding the X-Content-Type-Options: nosniff response header

Answer

Enabling dynamic compression

Answer

Configuring custom MIME type entries for all file types

Answer

Disabling static file serving

Question 7

A risk assessment reveals that IIS recycles application pools at fixed times, causing brief outages. Which configuration reduces this availability risk?

Accepted Answer

Switching to memory-based recycling thresholds with overlapping recycle mode

Answer

Disabling recycling entirely

Answer

Setting a very short recycle interval of 1 minute

Answer

Using a single global application pool for all sites