Which type of data is typically found in a proxy log and is essential for security monitoring?

Kerberos ticket-granting tickets for all domain users

Database query results from backend SQL servers

Full packet payloads of all encrypted traffic

Source IP address, destination URL, and HTTP method

A security analyst notices that the SIEM generates a high volume of alerts for proxy events that are not actually malicious. The team wants to reduce false positives while still detecting real threats. Which approach should the analyst take?

Refine the correlation rules with additional context, such as user role and destination reputation.

Forward only proxy logs from high-risk users to the SIEM.

Increase the correlation window for all proxy-related rules.

Disable all proxy-related correlation rules.

A security team is sending proxy logs to their SIEM via syslog. They notice that some logs are missing during peak traffic hours. The proxy is configured to send logs to the SIEM over UDP. What is the most likely cause of the missing logs?

The proxy is configured to send logs to the wrong port.

The SIEM is not parsing the logs correctly.

The proxy is generating logs in a format the SIEM does not support.

UDP is a connectionless protocol and can drop packets when the SIEM is overwhelmed.

A SOC team wants to use the SIEM to provide a single view of security events across the organization, including proxy logs, firewall logs, and endpoint logs. Which SIEM function is primarily responsible for this capability?

Threat intelligence integration

Centralized log management and normalization

GIAC Continuous Monitoring Certification

Domain 2Objective 4

Proxies & SIEM GMON Practice Questions (Page 2)

Part of the Network Monitoring and Protection domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

9concepts

Questions 6–10

6foundation · easy
Which type of data is typically found in a proxy log and is essential for security monitoring?
Select an answer first
7application · medium
A security analyst notices that the SIEM generates a high volume of alerts for proxy events that are not actually malicious. The team wants to reduce false positives while still detecting real threats. Which approach should the analyst take?
Select an answer first
8application · medium
A security team is sending proxy logs to their SIEM via syslog. They notice that some logs are missing during peak traffic hours. The proxy is configured to send logs to the SIEM over UDP. What is the most likely cause of the missing logs?
Select an answer first
9application · medium
A SOC team wants to use the SIEM to provide a single view of security events across the organization, including proxy logs, firewall logs, and endpoint logs. Which SIEM function is primarily responsible for this capability?
Select an answer first
10foundation · easy
Which proxy deployment model requires each client application to be explicitly configured to send traffic through the proxy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.