GCIA · Question #33
You work as a Network Administrator for SmartCert Inc. The company's network contains five Windows 2003 servers and ninety Windows XP Professional client computers. You want to view all the incoming r
The correct answer is C. Use the URLScan tool.. URLScan is a Microsoft IIS security tool that filters HTTP requests using administrator-defined rules and scans URLs for suspicious characters to block intrusion attempts.
Question
You work as a Network Administrator for SmartCert Inc. The company's network contains five Windows 2003 servers and ninety Windows XP Professional client computers. You want to view all the incoming requests to an Internet Information Services (IIS) server and allow only requests that comply with a rule set, created by you, to be processed. You also want to detect the intrusion attempts by recognizing the strange characters in a URL on a Web server. What will you do to accomplish the task?
Options
- AUse the Remote Desktop Protocol (RDP).
- BUse the HFNETCHK utility.
- CUse the URLScan tool.
- DConfigure a connection to the SQL database by using the RELOG command-line utility.
How the community answered
(40 responses)- A5% (2)
- B8% (3)
- C85% (34)
- D3% (1)
Why each option
URLScan is a Microsoft IIS security tool that filters HTTP requests using administrator-defined rules and scans URLs for suspicious characters to block intrusion attempts.
Remote Desktop Protocol (RDP) provides remote graphical desktop access to Windows machines and has no capability to inspect, filter, or analyze HTTP requests arriving at an IIS server.
HFNETCHK is a command-line utility used to audit the hotfix and patch status of Windows systems, not to inspect or filter incoming web server requests.
URLScan is a free Microsoft security tool that inspects every incoming HTTP request to IIS and allows or denies processing based on a configurable rule set defined by the administrator. It can detect unusual or malicious characters in URLs, query strings, and headers, making it effective for both request filtering and identifying intrusion attempts. This directly satisfies both requirements stated in the question.
RELOG is a command-line tool for converting Windows performance counter log files between formats and has no functionality related to filtering or inspecting HTTP requests on IIS.
Concept tested: IIS HTTP request filtering using URLScan tool
Source: https://learn.microsoft.com/en-us/iis/extensions/working-with-urlscan/urlscan-overview
Topics
Community Discussion
No community discussion yet for this question.