Application and Proxy Monitoring GCTD Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company's web application is behind a load balancer. The security team notices that the application logs show a sudden increase in 500 errors, but the proxy logs show that the requests are being forwarded to the backend servers. The team suspects that the backend servers are overwhelmed. What is the best way to confirm this?

   • AIncrease the number of backend servers to see if the errors stop.
   • BLook at the application logs for the specific error messages to see if they are all the same.
   • CCheck the proxy logs for the response times of the requests that resulted in 500 errors.
   • DCorrelate the application error logs with the backend server performance metrics (e.g., CPU, memory) from the same time period.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization's web application uses a third-party identity provider (IdP). The security team detects a series of successful logins from unusual geographic locations, but the application logs do not contain the IdP's session data. Which action would best improve detection of account takeover?

   • ARequire multi-factor authentication for all users immediately.
   • BIncrease the application's logging level to capture more request details.
   • CIntegrate the IdP's authentication logs into the SIEM and correlate them with application activity logs.
   • DBlock all logins from geographic locations outside the company's normal operating regions.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of proxy monitoring in securing cloud traffic?

   • ATo store all cloud data in a central repository for compliance purposes.
   • BTo inspect and log traffic that passes through a proxy to detect malicious activities and policy violations.
   • CTo replace the need for encryption by ensuring all traffic is plaintext.
   • DTo manage user identities and authenticate users before they access cloud services.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst is reviewing proxy logs and notices a pattern: a single internal IP is making requests to multiple external domains that are known to be newly registered and have low reputation scores. The requests are small and frequent, occurring every few seconds. What should the analyst do first?

   • AImmediately quarantine the internal IP from the network.
   • BIgnore the traffic because it is outbound and does not affect the internal network.
   • CCreate an alert for that internal IP and block the domains at the proxy.
   • DInvestigate the internal IP to determine if the traffic is from a compromised host or a legitimate application.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Why is proxy monitoring important for cloud security?

   • AIt automatically blocks all traffic from unknown IP addresses.
   • BIt provides visibility into outbound and inbound traffic that might otherwise be hidden from network monitoring tools.
   • CIt ensures that all cloud services are running the latest version.
   • DIt encrypts all data at rest in the cloud environment.
   Reveal Solution Discussion Select an answer first