Application and Proxy Monitoring GCTD Practice Questions (Page 7)

Questions 31–35

1. 31expert · medium

   A security operations center (SOC) is overwhelmed by alerts from both application and proxy monitoring. They want to reduce false positives while ensuring that real threats are not missed. They have a limited budget and cannot afford a commercial UEBA tool. Which approach would best achieve this goal?

   • AImplement a simple scoring system that assigns points for each suspicious event and only alerts when the total score exceeds a threshold.
   • BCreate correlation rules that link application login failures with proxy anomalies, such as multiple failed logins followed by a successful login from a new IP that also appears in proxy logs as a CONNECT to an external host.
   • CDisable proxy monitoring alerts and rely solely on application logs.
   • DIncrease the alert thresholds for both application and proxy alerts to reduce the number of notifications.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security analyst is investigating a potential data breach. The application logs show that a user downloaded a large number of records, and the proxy logs show that the same user accessed a file-sharing site shortly after. Which correlation would provide the strongest evidence of data exfiltration?

   • AThe user's IP address in the application log matches the IP address in the proxy log.
   • BThe file-sharing site is not on the company's blocklist.
   • CThe application log timestamp of the download and the proxy log timestamp of the file-sharing upload are within a few minutes, and the user's session ID matches.
   • DThe user's browser user agent is the same in both logs.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A cloud-native application is composed of multiple microservices that communicate over HTTP. The security team wants to detect lateral movement where an attacker compromises one service and then calls another service's internal API. Which monitoring approach would be most effective?

   • AMonitor the network traffic between services at the packet level.
   • BEnable distributed tracing and log all inter-service calls with source and destination service names, user identity, and payload metadata.
   • CMonitor the CPU usage of each microservice and alert on spikes.
   • DAlert on any service-to-service call that uses an API key.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is a common security anomaly that can be detected through application performance monitoring?

   • AA sudden increase in failed login attempts
   • BAn increase in available memory
   • CA change in the application's color scheme
   • DA decrease in CPU usage during peak hours
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security team is investigating a potential data breach. The application logs show that a user with administrative privileges downloaded a large amount of data from a database. The proxy logs show that the same user's workstation also made a request to an external file-sharing service around the same time. What is the most likely conclusion?

   • AThe user is performing a legitimate backup and the external request is unrelated.
   • BThe application logs are showing a false positive because the download was authorized.
   • CThe user is exfiltrating data to the external file-sharing service.
   • DThe proxy logs are showing traffic from a different user due to IP sharing.
   Reveal Solution Discussion Select an answer first