Application and Proxy Monitoring GCTD Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A web application team wants to detect SQL injection attempts in real time. They currently have access to the application's structured logs, which include the full URL, query parameters, and user agent. Which approach would best leverage these logs for detection?

   • ACount the number of 500 error responses and alert on spikes.
   • BParse the query parameters and run them through a regex pattern that matches common SQL injection payloads.
   • CAnalyze the user agent strings for known malicious patterns.
   • DMonitor the application's response time and alert when it exceeds a threshold.
   Reveal Solution Discussion Select an answer first
2. 7expert · medium

   A company runs a business-critical application that experiences periodic traffic spikes. The security team wants to detect application-level denial-of-service (DoS) attacks, but they cannot afford to hire additional staff to triage alerts. Which monitoring strategy would best balance detection accuracy and operational overhead?

   • AImplement an automated baseline of normal traffic patterns and alert only when the current traffic deviates significantly from the baseline, with a built-in delay to confirm the anomaly persists.
   • BSet a static threshold for requests per second and alert whenever it is exceeded.
   • CUse a commercial DDoS protection service that automatically mitigates attacks.
   • DAlert on every 5xx error response from the application.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst notices that a web application's authentication logs show a successful login for a user account from an IP address that is not in the company's known egress ranges. The proxy logs for the same time period show an HTTP CONNECT request to an external IP on port 443 from the same internal host. Which action would best confirm whether the login is malicious?

   • AReview the proxy log for the user's previous browsing history to see if they frequently use external proxies.
   • BCorrelate the proxy log's destination IP and timestamp with the application log's source IP and timestamp to see if they match the same session.
   • CCheck the application log for failed login attempts from the same IP before the successful login.
   • DBlock the external IP in the proxy immediately and reset the user's password.
   Reveal Solution Discussion Select an answer first
5. 9expert · medium

   A security team is investigating a potential insider threat. The application logs show that a user exported a large amount of customer data to a CSV file. The proxy logs show that the user then accessed a personal webmail service. However, the proxy logs do not show any upload of the CSV file. Which conclusion is most justified?

   • AThe investigation should be closed because there is no evidence of data leaving the network.
   • BThe user did not exfiltrate the data because the proxy logs show no upload.
   • CThe data may have been exfiltrated through an encrypted channel that the proxy could not inspect, such as SSH tunneling or a VPN.
   • DThe user's access to webmail is the primary indicator of exfiltration.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What format is commonly used for application logs to enable structured analysis?

   • AImage file format (e.g., PNG)
   • BJSON (JavaScript Object Notation)
   • CBinary executable format
   • DCompressed archive format (e.g., ZIP)
   Reveal Solution Discussion Select an answer first