Proxies & SIEM GMON Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which protocol is commonly used to forward proxy logs to a SIEM?

   • ASNMP
   • BSMTP
   • CSyslog
   • DFTP
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   After proxy logs are ingested into a SIEM, what is the next logical step to enable effective monitoring?

   • ARebooting the SIEM server to apply changes
   • BDeleting logs older than 24 hours to save space
   • CImmediately creating alerts for every URL visited
   • DParsing and normalizing the logs to extract relevant fields
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a core function of a Security Information and Event Management (SIEM) system?

   • AAggregating and normalizing log data from multiple sources
   • BEncrypting all network traffic to prevent intrusions
   • CGenerating new security patches for operating systems
   • DReplacing the need for firewalls and antivirus software
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A SIEM administrator is integrating proxy logs from multiple regional offices. Each office uses a different proxy vendor, and the log formats differ significantly. The administrator wants to create a unified correlation rule that works across all offices. Which step is essential before creating the rule?

   • ACreate separate correlation rules for each office.
   • BNormalize all proxy logs into a common schema.
   • CUse only one proxy vendor for all offices.
   • DStore logs from each office in separate SIEM instances.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which SIEM feature is used to reduce false positives by grouping related events into a single incident?

   • ALog encryption
   • BUser access reviews
   • CData retention policies
   • DEvent correlation and aggregation
   Reveal Solution Discussion Select an answer first