nerdexam
GIAC

GCIH · Question #47

Your company has been hired to provide consultancy, development, and integration services for a company named Brainbridge International. You have prepared a case study to plan the upgrade for the…

The correct answer is A. Customize IIS 6.0 to display a legal warning page on the generation of the 404.2 and C. Configure IIS 6.0 on WebStore1 to scan the URL for known buffer overflow attacks. Securing a public-facing IIS 6.0 web server involves configuring custom error responses for restricted extensions and enabling URL scanning to block buffer overflow attempts.

Web Application Attacks & Post-Exploitation

Question

Your company has been hired to provide consultancy, development, and integration services for a company named Brainbridge International. You have prepared a case study to plan the upgrade for the company. Based on the case study, which of the following steps will you suggest for configuring WebStore1? Each correct answer represents a part of the solution. Choose two.

Options

  • ACustomize IIS 6.0 to display a legal warning page on the generation of the 404.2 and
  • BMove the WebStore1 server to the internal network.
  • CConfigure IIS 6.0 on WebStore1 to scan the URL for known buffer overflow attacks.
  • DMove the computer account of WebStore1 to the Remote organizational unit (OU).

How the community answered

(31 responses)
  • A
    77% (24)
  • B
    6% (2)
  • D
    16% (5)

Why each option

Securing a public-facing IIS 6.0 web server involves configuring custom error responses for restricted extensions and enabling URL scanning to block buffer overflow attempts.

ACustomize IIS 6.0 to display a legal warning page on the generation of the 404.2 andCorrect

Customizing IIS 6.0 to display a legal warning page on 404.2 errors alerts administrators when requests target locked-down ISAPI or CGI extensions, helping detect probing activity and enforcing access control policies on restricted resources.

BMove the WebStore1 server to the internal network.

Moving WebStore1 to the internal network would make it inaccessible to external customers, which is not viable for a public-facing e-commerce server.

CConfigure IIS 6.0 on WebStore1 to scan the URL for known buffer overflow attacks.Correct

Configuring IIS 6.0 to scan URLs for known buffer overflow patterns via URLScan or IIS lockdown filters prevents malicious oversized requests from reaching the web application and exploiting input parsing vulnerabilities.

DMove the computer account of WebStore1 to the Remote organizational unit (OU).

Moving the WebStore1 computer account to a different OU affects Group Policy application scope but does not directly harden the IIS configuration or mitigate web-facing attack vectors.

Concept tested: IIS 6.0 security hardening for public-facing web servers

Source: https://learn.microsoft.com/en-us/previous-versions/iis/6.0-sdk/ms525076(v=vs.90)

Topics

#IIS configuration#buffer overflow protection#web server hardening#404 error handling

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice