Application and Proxy Monitoring GCTD Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company uses a forward proxy for all outbound internet traffic. The security team wants to detect data exfiltration attempts where a user uploads large files to a personal cloud storage service. Which proxy log field is most useful for this detection?

   • AThe size of the request body
   • BThe destination IP address
   • CThe HTTP method (e.g., POST vs GET)
   • DThe user agent string
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following best describes the role of application monitoring in a cloud threat detection strategy?

   • AIt provides early detection of application-level attacks such as injection, broken authentication, and business logic abuse.
   • BIt encrypts all data transmitted between the application and its users.
   • CIt ensures that all cloud resources are properly configured according to compliance standards.
   • DIt blocks malicious IP addresses at the network perimeter.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security analyst is investigating a potential account takeover. The application logs show a successful login for user 'jsmith' from IP 203.0.113.5 at 10:00 UTC. The proxy logs show that at 10:01 UTC, a request was made to a known phishing domain from the same IP. However, the application logs do not show any subsequent activity for 'jsmith' after the login. What is the most likely explanation?

   • AThe application logs are incomplete and missing the user's subsequent actions.
   • BThe user's session was hijacked and used to access the phishing domain.
   • CThe proxy logs are showing traffic from a different user on the same IP due to NAT.
   • DThe login was legitimate, and the user manually visited the phishing domain in a separate browser tab.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst is reviewing proxy logs and notices a series of CONNECT requests to various IP addresses on port 443 from a single workstation. The destinations are not on any blocklist, and the traffic volumes are low. What should the analyst do next to determine if this is malicious?

   • AImmediately block all the destination IPs in the firewall.
   • BIgnore the traffic because the destinations are not blocklisted.
   • CCompare the CONNECT request timestamps with the workstation's active directory login events and any scheduled tasks.
   • DCheck the proxy logs for the same destinations from other workstations.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What type of information is typically found in a proxy log?

   • ADatabase schema and query execution plans
   • BClient IP address, requested URL, and HTTP status code
   • CCPU temperature and fan speed of servers
   • DUser password hashes and authentication tokens
   Reveal Solution Discussion Select an answer first