A company hosts a public web application on Azure App Service. The security team wants to hide the origin server IP, terminate TLS centrally, and enforce WAF rules before traffic reaches the app. Which deployment should they choose?

Place a forward proxy in the user's browser configuration and route all outbound traffic through it.

Deploy a stateful firewall in transparent mode directly in front of the App Service without any proxy layer.

Configure Azure Front Door as a reverse proxy in front of the App Service and apply WAF policies to the Front Door endpoint.

Use Azure Application Gateway with a private IP and require clients to connect over a VPN.

An organization's security team is investigating a data breach. The firewall logs show outbound connections to an external IP on port 443, but the team cannot determine what data was sent. The firewall is a stateful firewall and does not perform TLS interception. Which action would have provided the most useful evidence?

Enable TLS interception on a forward proxy and log decrypted traffic.

Enable logging of all firewall rules.

Use a packet capture on the firewall.

Deploy a reverse proxy for outbound traffic.

An organization wants to protect its internal users from malicious websites by inspecting outbound HTTPS traffic. They also want to protect their public web server from inbound attacks. Which architecture best achieves both goals?

Deploy only a reverse proxy for all traffic.

Deploy a forward proxy for outbound traffic and a reverse proxy for inbound traffic.

Use a stateful firewall with no proxies.

Deploy only a forward proxy for all traffic.

GIAC Defensible Security Architect

Domain 3Objective 1

Network Proxies and Firewalls GDSA Practice Questions (Page 7)

Part of the Network Services and Encryption domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 31–35

31application · medium
A company hosts a public web application on Azure App Service. The security team wants to hide the origin server IP, terminate TLS centrally, and enforce WAF rules before traffic reaches the app. Which deployment should they choose?
Select an answer first
32expert · hard
An organization's security team is investigating a data breach. The firewall logs show outbound connections to an external IP on port 443, but the team cannot determine what data was sent. The firewall is a stateful firewall and does not perform TLS interception. Which action would have provided the most useful evidence?
Select an answer first
33foundation · easy
Which proxy feature enforces a security policy by blocking access to specific websites based on their domain or URL?
Select an answer first
34application · medium
An organization wants to protect its internal users from malicious websites by inspecting outbound HTTPS traffic. They also want to protect their public web server from inbound attacks. Which architecture best achieves both goals?
Select an answer first
35application · medium
A security analyst needs to investigate a potential data exfiltration incident. They need to determine which internal users accessed a specific external website and what data was uploaded. Which logging source would provide the most relevant evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.

Network Proxies and Firewalls GDSA Practice Questions (Page 7)

Questions 31–35

A company hosts a public web application on Azure App Service. The security team wants to hide the origin server IP, terminate TLS centrally, and enforce WAF rules before traffic reaches the app. Which deployment should they choose?

Which proxy feature enforces a security policy by blocking access to specific websites based on their domain or URL?

An organization wants to protect its internal users from malicious websites by inspecting outbound HTTPS traffic. They also want to protect their public web server from inbound attacks. Which architecture best achieves both goals?

A security analyst needs to investigate a potential data exfiltration incident. They need to determine which internal users accessed a specific external website and what data was uploaded. Which logging source would provide the most relevant evidence?

Keep studying — Network Services and Encryption