A company runs a public web application on Azure VMs behind an Azure Load Balancer. The security team wants to inspect all inbound HTTPS traffic for malicious payloads before it reaches the web servers, and also wants to hide the web server IP addresses from clients. Which solution should they implement?

Deploy a forward proxy in the DMZ and configure the web servers to use it for outbound requests.

Place a reverse proxy in front of the web servers and enable SSL inspection and payload filtering on it.

Add a network security group rule that blocks all inbound traffic except from the load balancer's frontend IP.

Configure the Azure Load Balancer to perform deep packet inspection on all incoming HTTPS requests.

A small company wants to deploy a firewall to segment its network into an internal LAN and a DMZ for public servers. They have limited IP addresses and want to avoid renumbering existing devices. Which firewall deployment mode should they choose?

Use a virtual firewall in the cloud without physical segmentation.

Transparent (bridge) mode with the firewall acting as a Layer-2 bridge.

Deploy the firewall in NAT mode to hide internal IPs.

Routed mode with different subnets for the LAN and DMZ.

A network admin is configuring a firewall for a small office. They have a single public IP and multiple internal servers that need to be accessible from the internet (web, email, and FTP). They want to minimize the number of public IPs used and ensure that only the necessary ports are exposed. Which approach is best?

Use destination NAT (port forwarding) to map specific public ports to internal server IPs and ports.

Configure the firewall to allow all inbound traffic to the internal servers.

Place all servers on the public IP using a DMZ with no NAT.

Use a reverse proxy to forward all traffic to the internal servers.

How do proxies and firewalls complement each other in a layered defense strategy?

Firewalls are used only for outbound traffic, while proxies are used only for inbound traffic

Firewalls filter traffic based on IP/port, while proxies provide deeper content inspection and policy enforcement

Firewalls provide application-level inspection, while proxies provide network-level filtering

Proxies replace the need for firewalls entirely

A company wants to mediate all outbound internet traffic from employee workstations to enforce security policies and to cache frequently accessed content to reduce bandwidth. Which proxy deployment should they choose?

A network address translation (NAT) device.

A forward proxy configured as an explicit proxy in the corporate network.

A transparent proxy that intercepts traffic without client configuration.

A reverse proxy placed in front of the corporate web servers.

GIAC Defensible Security Architect

Domain 3Objective 1

Network Proxies and Firewalls GDSA Practice Questions (Page 6)

Part of the Network Services and Encryption domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 26–30

26application · medium
A company runs a public web application on Azure VMs behind an Azure Load Balancer. The security team wants to inspect all inbound HTTPS traffic for malicious payloads before it reaches the web servers, and also wants to hide the web server IP addresses from clients. Which solution should they implement?
Select an answer first
27application · medium
A small company wants to deploy a firewall to segment its network into an internal LAN and a DMZ for public servers. They have limited IP addresses and want to avoid renumbering existing devices. Which firewall deployment mode should they choose?
Select an answer first
28expert · hard
A network admin is configuring a firewall for a small office. They have a single public IP and multiple internal servers that need to be accessible from the internet (web, email, and FTP). They want to minimize the number of public IPs used and ensure that only the necessary ports are exposed. Which approach is best?
Select an answer first
29foundation · easy
How do proxies and firewalls complement each other in a layered defense strategy?
Select an answer first
30application · medium
A company wants to mediate all outbound internet traffic from employee workstations to enforce security policies and to cache frequently accessed content to reduce bandwidth. Which proxy deployment should they choose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.

Network Proxies and Firewalls GDSA Practice Questions (Page 6)

Questions 26–30

A small company wants to deploy a firewall to segment its network into an internal LAN and a DMZ for public servers. They have limited IP addresses and want to avoid renumbering existing devices. Which firewall deployment mode should they choose?

How do proxies and firewalls complement each other in a layered defense strategy?

A company wants to mediate all outbound internet traffic from employee workstations to enforce security policies and to cache frequently accessed content to reduce bandwidth. Which proxy deployment should they choose?

Keep studying — Network Services and Encryption