Application and Proxy Monitoring GCTD Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company's web application is behind a forward proxy. The security team notices that the proxy logs show repeated HTTP 403 responses for a specific user, but the application logs show successful logins for that same user. The team wants to determine whether the user is being blocked by the proxy or if the application is misconfigured. What is the most effective next step?

   • ACorrelate the proxy and application logs by timestamp and user session ID to see if the 403s align with application requests or with other traffic.
   • BDisable the proxy for that user to see if the application works directly.
   • CCheck the application's authentication logs to confirm the user's IP address matches the proxy's IP address.
   • DIncrease the proxy log verbosity and wait for the issue to recur.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team is reviewing proxy logs and notices that a single user account is accessing a wide range of domains that are categorized as 'uncategorized' by the proxy's URL filter. The user is a finance employee. Which action should the team take?

   • AReset the user's password immediately.
   • BCorrelate the proxy logs with the user's authentication logs and endpoint detection data to determine if the activity is consistent with their job function.
   • CBlock all 'uncategorized' domains for the finance department.
   • DIgnore the activity because 'uncategorized' domains are not known malicious.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a common application log source used for monitoring in cloud environments?

   • AHypervisor event logs
   • BWeb server access logs (e.g., Apache, Nginx)
   • CNetwork flow logs from routers
   • DDNS query logs
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A cloud-based application is experiencing intermittent slowdowns. The operations team has access to application logs that show response times, but they also have proxy logs that show request/response sizes. They suspect that a specific API endpoint is being abused by a client that sends large payloads. How can they confirm this using the available data?

   • AReview the proxy logs for the client's IP address and see if it is making many requests.
   • BCompare the response times in the application logs with the request sizes in the proxy logs for that endpoint.
   • CEnable verbose logging on the application server to capture full request bodies.
   • DLook only at the application logs to see if the endpoint's error rate increased.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What type of malicious activity can be detected by monitoring proxy logs?

   • ASQL injection attempts against a database
   • BWeak encryption algorithms used by the application
   • CCommand and control (C2) communication
   • DMisconfigured firewall rules
   Reveal Solution Discussion Select an answer first