Why should unnecessary ISAPI filters be disabled or removed?

Why should unnecessary ISAPI filters be disabled or removed?

• A. To improve database performance.
• B. To reduce bandwidth usage.
• C. To simplify SSL configuration.
• D. To defend against webserver attacks.

Answer: (D)

Reducing the web server’s attack surface by removing unused ISAPI filters. ISAPI filters are dynamic modules loaded into the IIS process that can alter how requests and responses are handled. If a filter is unnecessary, disabled, or poorly secured, it becomes a potential entry point for attackers to execute code, access data, or take control of the server. Keeping only the filters you truly need minimizes the number of code paths an attacker could exploit, making the server harder to compromise. The other options don’t address this security risk as directly: removing filters isn’t primarily about database performance or bandwidth, and while filters can influence SSL handling, the central benefit here is reducing exposed functionality to defend against webserver attacks.

Reducing the web server’s attack surface by removing unused ISAPI filters. ISAPI filters are dynamic modules loaded into the IIS process that can alter how requests and responses are handled. If a filter is unnecessary, disabled, or poorly secured, it becomes a potential entry point for attackers to execute code, access data, or take control of the server. Keeping only the filters you truly need minimizes the number of code paths an attacker could exploit, making the server harder to compromise. The other options don’t address this security risk as directly: removing filters isn’t primarily about database performance or bandwidth, and while filters can influence SSL handling, the central benefit here is reducing exposed functionality to defend against webserver attacks.