Proxies & SIEM GMON Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company is integrating proxy logs into a SIEM. The proxy is located in a DMZ and the SIEM is in the internal network. The security team is concerned about the security of the log transmission. Which method should they use to securely send proxy logs to the SIEM?

   • AUse a shared network drive to drop log files.
   • BSend logs via email to the SIEM administrator.
   • CUse TLS-encrypted syslog (e.g., syslog over TLS) with authentication.
   • DSend logs via unencrypted UDP syslog.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A SIEM analyst is tuning a correlation rule that alerts when a user accesses a known malicious domain. The rule is generating false positives because the proxy logs include a 'destination host' field that sometimes contains the IP address instead of the domain name. The SIEM's threat intelligence feed only contains domain names. Which approach should the analyst take to reduce false negatives?

   • AEnrich the proxy logs with reverse DNS lookups before correlation.
   • BIgnore proxy logs that contain IP addresses.
   • CRemove the correlation rule because it is unreliable.
   • DChange the rule to alert on any connection to an IP address.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   An organization wants to deploy a proxy that requires no client configuration and intercepts traffic at the network layer. Which proxy deployment model best fits this requirement?

   • AExplicit proxy
   • BInline proxy
   • CReverse proxy
   • DTransparent proxy
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the first step in integrating proxy logs with a SIEM?

   • AConfiguring the proxy to forward logs to the SIEM collector
   • BDeploying endpoint agents on all workstations
   • CCreating correlation rules for proxy data
   • DDisabling TLS interception on the proxy
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security analyst is developing a SIEM use case to detect DNS tunneling through the proxy. The proxy logs include the destination domain and the bytes sent and received. Which pattern in the proxy logs is most indicative of DNS tunneling?

   • AA user downloading a large file from a file-sharing site.
   • BA high volume of DNS requests to a single domain with large response sizes.
   • CA user accessing a domain with a long subdomain.
   • DA server making periodic requests to a known malware domain.
   Reveal Solution Discussion Select an answer first