Open Source Network Security Proxies GNFA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An analyst is investigating a possible data breach. The Squid proxy logs show that a user downloaded a large file from an external site. The analyst needs to determine if the file was actually transferred completely and whether it matches a known malware hash. Which combination of proxy data and additional evidence would be most conclusive?

   • AThe proxy log entry with the response size and the user's browser download history.
   • BThe proxy log entry showing the request and the response size, plus the file's hash from the destination server's logs.
   • CThe proxy log entry showing the URL and the user's IP address, plus the user's statement that they downloaded the file.
   • DA packet capture taken at the proxy during the download, from which the file can be reassembled and hashed.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   An organization wants to cache frequently accessed web content to reduce bandwidth usage and speed up client access. Which open source proxy is best suited for this purpose?

   • AHAProxy
   • BSquid
   • CVarnish
   • DNginx
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A network administrator is deploying a proxy to monitor and log all traffic between a DMZ web server and the internet. The proxy must be able to handle high throughput and provide detailed logging of requests and responses. Which open source proxy is best suited for this inline monitoring role?

   • AHAProxy configured as a reverse proxy with full logging enabled (httplog) and placed in front of the web server.
   • BNginx configured as a forward proxy for the web server's outbound requests.
   • CA transparent Squid proxy on the internal network, not in the DMZ.
   • DSquid configured as a reverse proxy in front of the web server.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During an incident investigation, an analyst needs to correlate proxy logs with firewall logs to identify which internal host communicated with a command-and-control server. The proxy logs contain timestamps, client IPs, and URLs. Which field from the proxy logs is most critical for this correlation?

   • AUser-Agent string
   • BProxy server hostname
   • CClient IP address
   • DHTTP request method
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A small business wants to deploy an open source proxy to log all web traffic and block ads. They have limited hardware and need a simple solution. Which deployment is most appropriate?

   • AUse a commercial cloud proxy service
   • BDeploy HAProxy in front of the firewall
   • CInstall Squid on a single Linux server with a deny ACL for ad domains
   • DSet up a transparent proxy using iptables on the router
   Reveal Solution Discussion Select an answer first