A company is considering using a reverse proxy to protect their internal web application. They want to use the reverse proxy logs in their SIEM to detect attacks. Which of the following is a key advantage of using a reverse proxy for security monitoring?

It can replace the need for a SIEM.

It can decrypt and inspect all inbound traffic before it reaches the web server.

It can block all malicious traffic without generating logs.

It can monitor outbound employee web traffic.

A security analyst is explaining to a junior team member the basic purpose of a forward proxy. Which statement best describes the role of a forward proxy in network monitoring and protection?

It acts as an intermediary for client requests to external servers, allowing the organization to enforce policies and log outbound traffic.

It sits in front of internal servers to protect them from external clients, often performing load balancing and SSL termination.

It is a hardware device that only inspects inbound email traffic for spam and malware before delivery to the mail server.

It is a software agent installed on each endpoint that reports all network connections to a central management server.

A company wants to implement TLS interception on their forward proxy to inspect encrypted web traffic for malware. However, they are concerned about privacy and compliance. What is the best approach to balance security and privacy?

Intercept all TLS traffic and block any site with an invalid certificate.

Intercept all TLS traffic and store the decrypted content for later analysis.

Intercept TLS traffic but exclude categories like banking and healthcare from inspection.

Do not intercept TLS traffic; rely on endpoint detection to catch malware.

Which method is commonly used to collect proxy logs for centralized security monitoring?

Sending syslog messages from the proxy to a central log collector

Storing logs only on the proxy's local disk for manual review

Exporting logs to a USB drive weekly

Using SNMP traps to send full web requests to a database

GIAC Continuous Monitoring Certification

Domain 2Objective 4

Proxies & SIEM GMON Practice Questions (Page 3)

Part of the Network Monitoring and Protection domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

9concepts

Questions 11–15

11expert · hard
A company is considering using a reverse proxy to protect their internal web application. They want to use the reverse proxy logs in their SIEM to detect attacks. Which of the following is a key advantage of using a reverse proxy for security monitoring?
Select an answer first
12application · medium
A security operations center (SOC) receives thousands of proxy logs per second. The team wants to identify a user who is downloading a large file from a file-sharing site during off-hours. Which SIEM capability is most directly used to accomplish this?
Select an answer first
13foundation · easy
A security analyst is explaining to a junior team member the basic purpose of a forward proxy. Which statement best describes the role of a forward proxy in network monitoring and protection?
Select an answer first
14application · medium
A company wants to implement TLS interception on their forward proxy to inspect encrypted web traffic for malware. However, they are concerned about privacy and compliance. What is the best approach to balance security and privacy?
Select an answer first
15foundation · easy
Which method is commonly used to collect proxy logs for centralized security monitoring?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.