Microsoft Internet Information Server Risk Assessment & Management 5

Question 1

Which approach best manages the risk of unpatched IIS vulnerabilities in a production environment?

Accepted Answer

Implementing a patch management policy with regular Windows Update cycles

Answer

A structured patch management policy ensures CVEs are addressed systematically, reducing the window of exposure to known vulnerabilities.

Question 2

An IIS site accepts file uploads. Which Request Filtering setting directly reduces the risk of large-payload attacks?

Accepted Answer

maxAllowedContentLength

Answer

Setting maxAllowedContentLength limits the size of request bodies, preventing oversized upload attacks that could exhaust disk space or memory.

Question 3

From a risk management perspective, why should IIS administrators enable HTTP Strict Transport Security (HSTS)?

Accepted Answer

To prevent protocol downgrade attacks by forcing browsers to use HTTPS

Answer

HSTS instructs browsers to only connect via HTTPS, preventing attackers from stripping TLS and intercepting traffic via downgrade attacks.

Question 4

Which IIS auditing configuration helps satisfy the risk documentation requirements of compliance frameworks like PCI-DSS?

Accepted Answer

Configuring centralized W3C logging with sufficient fields retained for 90+ days

Answer

PCI-DSS requires audit trails with sufficient detail retained for at least a year; centralized W3C IIS logs satisfy this by capturing request, response, and client data.

Question 5

What risk is introduced when IIS application pools are configured with an excessively long idle timeout?

Accepted Answer

Memory leaks accumulate longer, increasing crash risk and potential resource exhaustion

Answer

A long idle timeout allows memory-leaking worker processes to accumulate allocations over time, eventually causing instability or denial-of-service conditions.

Microsoft Internet Information Server Practice Test

Microsoft Internet Information Server Practice Test

Microsoft Internet Information Server Risk Assessment & Management 5