312-50V10 · Question #55
Why should the security analyst disable/remove unnecessary ISAPI filters?
The correct answer is B. To defend against webserver attacks. Unnecessary ISAPI filters expand the IIS web server attack surface and must be removed as part of web server hardening to reduce exploitable vulnerabilities.
Question
Why should the security analyst disable/remove unnecessary ISAPI filters?
Options
- ATo defend against social engineering attacks
- BTo defend against webserver attacks
- CTo defend against jailbreaking
- DTo defend against wireless attacks
How the community answered
(32 responses)- A6% (2)
- B91% (29)
- D3% (1)
Why each option
Unnecessary ISAPI filters expand the IIS web server attack surface and must be removed as part of web server hardening to reduce exploitable vulnerabilities.
Social engineering attacks exploit human psychology and trust rather than server-side software components, so disabling ISAPI filters has no effect on them.
ISAPI filters are DLL-based components that integrate directly into IIS and intercept HTTP requests, giving them deep access to web server processing. Unneeded or poorly coded ISAPI filters can contain buffer overflow flaws, allow code injection, or be abused to escalate privileges on the web server. Removing them is a standard IIS hardening step that directly reduces the number of potential attack vectors against the web server.
Jailbreaking refers to bypassing restrictions on mobile or embedded operating systems and has no relationship to ISAPI filter configuration on IIS web servers.
Wireless attacks target radio frequency protocols and network-layer infrastructure, which are entirely separate from the ISAPI filter mechanism running on a web server.
Concept tested: IIS ISAPI filter hardening to reduce web server attack surface
Source: https://learn.microsoft.com/en-us/iis/manage/configuring-security/use-request-filtering
Topics
Community Discussion
No community discussion yet for this question.