Proxies & SIEM GMON Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which statement correctly describes the primary function of a reverse proxy?

   • AIt forwards client requests to internal servers, providing an additional layer of defense and hiding the internal server details.
   • BIt filters outbound traffic from internal users to prevent data exfiltration.
   • CIt caches frequently accessed web pages to reduce bandwidth usage for internal clients.
   • DIt encrypts all traffic between the internal network and the internet using a VPN tunnel.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What does 'normalization' mean in the context of SIEM data ingestion?

   • ARemoving all log entries that are not security-related
   • BCompressing logs to reduce storage costs
   • CEncrypting logs before transmission to the SIEM
   • DConverting disparate log formats into a common, structured format
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A SIEM administrator is integrating proxy logs into the SIEM. The proxy logs contain timestamps in a non-standard format and field names that differ from the SIEM's standard schema. What should the administrator do to ensure the logs are usable for correlation?

   • AAsk the proxy vendor to change the log format to match the SIEM.
   • BConfigure the SIEM to parse and normalize the logs into the standard schema.
   • CUse a separate SIEM instance for proxy logs.
   • DStore the raw logs in the SIEM without any transformation.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which SIEM use case is specifically designed to detect data exfiltration using proxy logs?

   • AReviewing firewall rules for misconfigurations
   • BTracking the number of open ports on internal servers
   • CMonitoring for failed login attempts on the domain controller
   • DMonitoring for unusually large outbound file uploads to external sites
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company uses a forward proxy for all outbound web traffic. The security team wants to detect data exfiltration attempts by analyzing the size and frequency of uploads to external sites. Which proxy log fields should the team forward to the SIEM to support this use case?

   • ADestination IP, server response time, and HTTP status code
   • BUser agent, browser version, and operating system
   • CProxy server name, interface index, and packet loss rate
   • DSource IP, destination URL, bytes sent, and timestamp
   Reveal Solution Discussion Select an answer first