Proxies & SIEM GMON Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A SIEM analyst is creating a correlation rule to detect a user accessing a known phishing site. The proxy logs contain the destination URL, but the threat intelligence feed contains only the domain name. The analyst wants to reduce false negatives. Which approach should they take?

   • AExtract the domain from the URL and compare it to the threat intelligence feed.
   • BCompare the full URL to the threat intelligence feed.
   • CUse the proxy's destination IP instead of the URL.
   • DAlert on any URL that contains a dot.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company is considering deploying a transparent proxy to monitor all outbound web traffic. They are concerned about the impact on network performance and the ability to attribute traffic to specific users. What is a key consideration when using a transparent proxy?

   • ATransparent proxies require client-side configuration to route traffic through them.
   • BTransparent proxies are always slower than explicit proxies.
   • CTransparent proxies can only inspect HTTP traffic, not HTTPS.
   • DTransparent proxies may not be able to identify individual users without additional authentication or IP mapping.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A SIEM analyst is creating a correlation rule to detect potential data exfiltration via the corporate proxy. The rule should trigger when a user uploads a large amount of data to a cloud storage service. Which combination of proxy log fields would be most effective for this rule?

   • ASource IP, destination IP, and response time.
   • BSource IP, destination domain, and bytes sent.
   • CSource IP, user agent, and request method.
   • DDestination IP, destination port, and protocol.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which proxy log field is most important for detecting command-and-control (C2) beaconing?

   • AUser agent string
   • BTimestamp and destination URL
   • CHTTP status code
   • DSource MAC address
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security analyst is developing a SIEM use case to detect command-and-control (C2) communication through the proxy. Which of the following proxy log patterns is most indicative of C2 activity?

   • AA client accessing a website with an expired SSL certificate.
   • BA user downloading a large file from a known software vendor.
   • CA user accessing a popular social media site during work hours.
   • DA server making regular, periodic requests to a newly registered domain.
   Reveal Solution Discussion Select an answer first