Application and Proxy Monitoring GCTD Practice Questions (Page 8)

Questions 36–40

1. 36expert · medium

   An organization uses a forward proxy that decrypts and inspects HTTPS traffic. The security team notices that some applications are failing because they use certificate pinning. They need to maintain security monitoring without breaking these applications. Which approach balances security and functionality?

   • ACreate a proxy bypass rule for the pinned applications, but log the bypass events and monitor them for anomalies.
   • BForce the applications to trust the proxy's certificate by modifying their configuration.
   • CBlock all pinned applications until they are updated to support the proxy.
   • DDisable HTTPS inspection for all traffic to avoid breaking any applications.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company's customer-facing web application experienced a breach where attackers exploited a vulnerability in a third-party library. The incident response team needs to determine the scope of the breach. Which application monitoring data would be most useful for this investigation?

   • AInfrastructure metrics such as CPU and memory usage during the breach window.
   • BProxy logs showing the destination IPs of outbound connections from the application servers.
   • CApplication logs that record the library version and all requests that invoked the vulnerable code path.
   • DNetwork flow logs showing connections to the application's load balancer.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security team is investigating a potential brute-force attack on a web application. The application logs show multiple failed login attempts for the same username from different IP addresses. The proxy logs show that these IP addresses are all from the same geographic region. What is the best way to confirm the attack?

   • ACheck the proxy logs for the user agent strings of the failed attempts.
   • BCorrelate the failed login timestamps with the proxy logs to see if the requests originated from the same proxy session.
   • CLook at the application logs for the username to see if the password was eventually correct.
   • DBlock all IP addresses from that geographic region.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company's web application is behind a content delivery network (CDN). The security team wants to detect attacks that originate from the CDN's edge nodes, which mask the true client IP. Which application log source would provide the most reliable client IP information?

   • AThe application's server logs that record the direct TCP connection IP.
   • BThe CDN's own access logs that show the edge node's IP.
   • CThe application's access logs that capture the 'X-Forwarded-For' header from the CDN.
   • DThe application's error logs that contain stack traces.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security team is designing an alerting system for their web application and proxy. They want to minimize false positives while still detecting potential command-and-control (C2) traffic. Which approach best balances these goals?

   • AAlert on any outbound connection to a domain with a low reputation score.
   • BAlert only when a low-reputation domain is accessed by multiple internal hosts within a short time window.
   • CAlert when a low-reputation domain is accessed and the request pattern matches known C2 behavior (e.g., periodic beaconing).
   • DAlert on any outbound connection to a domain that is not on the company's approved domain list.
   Reveal Solution Discussion Select an answer first