An analyst is deploying Squid as a forward proxy for a small office. They need to ensure that all HTTP requests are logged with client IP addresses and that access to a known malware domain is blocked. Which configuration steps are required?

Configure proxy authentication with LDAP

Enable access logging with logformat including client IP, and add an ACL to deny the malware domain

Enable caching and set cache_dir to a large size

Set http_port to 3128 and enable SSL bump

A security team wants to intercept and log all outbound HTTP/HTTPS traffic from internal users to the internet, without requiring changes to every workstation's browser settings. They plan to place a proxy at the network edge and use firewall rules to redirect traffic. Which open source proxy deployment mode should they choose?

Forward proxy configured as a transparent proxy

Reverse proxy in front of the web servers

Forward proxy requiring explicit browser proxy configuration

SOCKS proxy with authentication

An organization uses Squid as a forward proxy. The security team wants to integrate proxy logs with their existing Zeek IDS to enrich network traffic analysis. Which approach is most effective?

Replace Zeek with Squid's logging capabilities

Export Squid logs to a central log collector and have Zeek ingest them via a custom script

Use HAProxy instead of Squid for better Zeek integration

Disable Squid logging to avoid duplicate data

During a forensic investigation, an analyst needs to prove that a specific user visited a prohibited website at a certain time. The proxy logs are the primary source. Which information is essential to establish this?

Timestamp, client IP, and full URL

GIAC Network Forensic Analyst

Domain 3Objective 1

Open Source Network Security Proxies GNFA Practice Questions (Page 2)

Part of the Security Controls and Monitoring domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–30 in this domain), expect 9–15 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

6concepts

Questions 6–10

6application · medium
An analyst is deploying Squid as a forward proxy for a small office. They need to ensure that all HTTP requests are logged with client IP addresses and that access to a known malware domain is blocked. Which configuration steps are required?
Select an answer first
7application · medium
A security team wants to intercept and log all outbound HTTP/HTTPS traffic from internal users to the internet, without requiring changes to every workstation's browser settings. They plan to place a proxy at the network edge and use firewall rules to redirect traffic. Which open source proxy deployment mode should they choose?
Select an answer first
8expert · hard
An organization uses Squid as a forward proxy. The security team wants to integrate proxy logs with their existing Zeek IDS to enrich network traffic analysis. Which approach is most effective?
Select an answer first
9foundation · easy
Which common log format can be used to export proxy logs to a SIEM tool for centralized analysis?
Select an answer first
10application · medium
During a forensic investigation, an analyst needs to prove that a specific user visited a prohibited website at a certain time. The proxy logs are the primary source. Which information is essential to establish this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.

Open Source Network Security Proxies GNFA Practice Questions (Page 2)

Questions 6–10

An analyst is deploying Squid as a forward proxy for a small office. They need to ensure that all HTTP requests are logged with client IP addresses and that access to a known malware domain is blocked. Which configuration steps are required?

An organization uses Squid as a forward proxy. The security team wants to integrate proxy logs with their existing Zeek IDS to enrich network traffic analysis. Which approach is most effective?

Which common log format can be used to export proxy logs to a SIEM tool for centralized analysis?

During a forensic investigation, an analyst needs to prove that a specific user visited a prohibited website at a certain time. The proxy logs are the primary source. Which information is essential to establish this?

Keep studying — Security Controls and Monitoring