What is the primary purpose of the correlation engine in a SIEM?

To identify relationships between events from different sources to detect potential threats

To automatically block malicious IP addresses at the firewall

To generate daily reports for management compliance

To store logs in a compressed format to save disk space

A security team wants to inspect HTTPS traffic for malware downloads while maintaining user privacy for personal browsing. Which proxy configuration should they implement?

Enable TLS interception only for traffic to sites in the malware category.

Use a forward proxy without any content inspection.

Disable TLS interception and rely on URL filtering only.

Enable TLS interception for all traffic and block all non-business sites.

A security team is evaluating a SIEM to centralize logs from their proxy, firewall, and endpoints. They want to be able to search across all logs quickly and identify suspicious activity. Which core SIEM function is most important for this requirement?

Data normalization and indexing.

A security team wants to detect command-and-control (C2) communication by analyzing proxy logs. Which SIEM use case would be most effective for this purpose?

Alert on any user visiting a social media site.

Alert on any HTTPS connection to a cloud provider.

Alert on repeated connections to a known malicious domain from multiple internal hosts.

Alert on proxy log entries with a high bytes-sent value.

A company hosts a public web application and wants to protect it from common web attacks while also hiding the origin server's IP address. The security team plans to deploy a proxy in front of the application. Which proxy type and configuration should they use?

Reverse proxy with web application firewall (WAF) rules

Inline proxy with TLS interception

Forward proxy with URL filtering enabled

Transparent proxy with content inspection

GIAC Continuous Monitoring Certification

Domain 2Objective 4

Proxies & SIEM GMON Practice Questions (Page 8)

Part of the Network Monitoring and Protection domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

9concepts

Questions 36–40

36foundation · easy
What is the primary purpose of the correlation engine in a SIEM?
Select an answer first
37application · medium
A security team wants to inspect HTTPS traffic for malware downloads while maintaining user privacy for personal browsing. Which proxy configuration should they implement?
Select an answer first
38application · medium
A security team is evaluating a SIEM to centralize logs from their proxy, firewall, and endpoints. They want to be able to search across all logs quickly and identify suspicious activity. Which core SIEM function is most important for this requirement?
Select an answer first
39application · medium
A security team wants to detect command-and-control (C2) communication by analyzing proxy logs. Which SIEM use case would be most effective for this purpose?
Select an answer first
40application · medium
A company hosts a public web application and wants to protect it from common web attacks while also hiding the origin server's IP address. The security team plans to deploy a proxy in front of the application. Which proxy type and configuration should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.