Application and Proxy Monitoring GCTD Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a common proxy log source?

   • AKernel system logs
   • BSquid proxy access logs
   • CContainer runtime logs
   • DDatabase transaction logs
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is a common field used to correlate application and proxy logs?

   • ACPU model number
   • BOperating system version
   • CDatabase table name
   • DSource IP address
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst is reviewing application logs for a web application that uses a third-party authentication service (e.g., OAuth). The analyst wants to detect account enumeration attacks where an attacker tries to determine if an email address is registered. Which log field is most likely to reveal this?

   • AThe user agent string of the client.
   • BThe HTTP status code returned by the authentication endpoint.
   • CThe timestamp of the request.
   • DThe IP address of the client making the request.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team is setting up alerts for their proxy logs. They want to detect when a user attempts to access a known malicious domain. The proxy logs contain the domain name in the URL field. What is the most efficient way to implement this alert?

   • AAlert on any domain that is accessed only once by a user.
   • BCreate a rule that matches the domain against a threat intelligence feed of known malicious domains.
   • CManually review the proxy logs daily for any domain that looks suspicious.
   • DBlock all domains that are not on the company's approved domain list.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company's web application is experiencing a performance degradation. The application logs show that a specific API endpoint is taking longer to respond, but the proxy logs show that the request volume to that endpoint is normal. What is the most likely cause?

   • AAn increase in the size of the responses from that endpoint.
   • BA bottleneck in the application code or database queries for that endpoint.
   • CA network issue between the proxy and the application server.
   • DA DDoS attack targeting that specific endpoint.
   Reveal Solution Discussion Select an answer first