IIS application pools can have memory limits configured through several settings: 'Private Memory Limit' (kernel-mode limit on private bytes), 'Virtual Memory Limit' (limits virtual address space), and 'Request Memory Limit' (per-request memory threshold). When these limits are exceeded, IIS can recycle the worker process, take no action, or trigger other configurable responses. This prevents runaway processes from consuming all server memory.