Security Settings

Question 1

Directory Browsing

Answer 1

• Open IIS Manager through the Server Manager
• Expand Host
• Expand Sites
• Select Default Website
• Select Directory Browsing
• Select Disable (If the option is Enable, directory browsing is already disabled.)
• Select Apply

Question 2

Ping Flood

Answer 2

• Open Firewall
• In the Inbound/Outbound security rules disable any protocol relating to ICMP echo requests

Question 3

Logs

Answer 3

• Open IIS Manager through the Server Manager
• Expand Host
• Expand Sites
• Select Default Website
• Select Logging
• Change the Logging directory

Question 4

FTP

Answer 4

• Open the Remove Roles and Features Wizard through the Server manager
• Select Server Roles
• Expand Web Server (IIS)
• Deselect FTP Server

Question 5

Loose Lipped Errors

Answer 5

• Open IIS Manager through the Server Manager
• Expand Host
• Expand Sites
• Select Default Website
• Select Error Pages
• Select Edit Feature Settings…
• Select Custom
• Select Okay

Question 6

SQL Injection

Answer 6

The “striplashes()” function removes backslashes. The “mysql_real_escape_string()” function removes special characters from a string used for an SQL statement. Conditional statements determine that the string is the desired data, clarifying that there is no code in the string.

Question 7

XSS Reflected

Answer 7

The JavaScript function “htmlspecialchars()” turns special characters that would normally run a malicious function into normal characters that are read as part of a string.

Question 8

XSS Stored

Answer 8

The JavaScript function “striplashes()” removes backslashes; the “mysql_real_escape_string()” function removes special characters from a string used for an SQL statement; and “htmlspecialchars” turns special characters that would normally run a malicious function into normal characters that are read as part of a string.

Question 9

Command Execution

Answer 9

If necessary, separate data into smaller sections and make sure it is what’s desired.

Question 10

General Web/Server Prevention

Answer 10

• Use the JavaScript function to “striplashes()” to remove backslashes from a variable.
• Use the JavaScript function “mysql_real_escape_string()” to remove special characters from a string used for an SQL statement.
• Use the JavaScript function “htmlspecialchars” to turn special characters that would normally run a malicious function into normal characters that are read as part of a string.
• Use the JavaScript function “is_numeric()” to make sure data that is supposed to be numeric only contains numbers.
• You can break apart a variable into smaller chunks during sanitization.
• Use conditional statements to clarify that a variable is what it is intended to be.