Application and Proxy Monitoring GCTD Practice Questions (Page 9)

Questions 41–45

1. 41expert · medium

   A company runs a legacy web application that cannot be modified to add structured logging. The security team needs to detect application-level attacks such as path traversal and command injection. They have access to the raw web server access logs and a forward proxy that logs all outbound traffic. Which approach would be most effective given the constraints?

   • AEnable error logging on the web server and monitor for stack traces.
   • BDeploy a network intrusion detection system (NIDS) inline before the web server.
   • CUse the proxy logs to detect outbound connections that occur immediately after suspicious requests.
   • DParse the web server access logs to extract the request URI and query strings, then apply signature-based detection for known attack patterns.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security team has set up monitoring for their web application and forward proxy. They want to create an alert that triggers when a user account is used from two different geographic locations within a short time, which could indicate credential theft. What is the best way to implement this alert?

   • AUse only the application logs to track login locations and alert on any two different locations within an hour.
   • BUse only the proxy logs to track the user's IP address and alert on any change in geolocation.
   • CCorrelate the application authentication logs with the proxy logs to compare the source IP geolocation for the same user session.
   • DSet up a rule that blocks any login from a different country than the user's registered address.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company is implementing a forward proxy to monitor outbound traffic. The security team wants to ensure they can detect malware that uses HTTPS to communicate with C2 servers. What is the most important capability the proxy must have?

   • AThe ability to decrypt and inspect HTTPS traffic using SSL/TLS interception.
   • BThe ability to block traffic based on the destination IP address.
   • CThe ability to log the source IP of each request.
   • DThe ability to cache frequently accessed web content.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which technique is used to monitor proxy traffic for malicious activity?

   • ADeleting logs older than 24 hours to reduce noise
   • BBlocking all traffic from non-corporate IP addresses
   • CAnalyzing proxy logs for unusual destination domains or data exfiltration patterns
   • DEncrypting all proxy logs to prevent tampering
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which technique is used to monitor application performance and detect security anomalies?

   • ADisabling logging to reduce storage costs
   • BConfiguring the application to ignore all error messages
   • CScanning the application's source code for vulnerabilities
   • DAnalyzing application response times and error rates for unusual patterns
   Reveal Solution Discussion Select an answer first