Open Source Network Security Proxies GNFA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An organization uses Squid as its forward proxy. The security team wants to receive real-time alerts when a user attempts to access a known malicious URL. Which integration approach provides the most immediate and automated alerting?

   • AUse Squid's redirect_program to send each requested URL to a local script that checks against a threat-intel feed and triggers an alert if matched.
   • BEnable Squid's cache_mgr email notifications for every denied request.
   • CExport Squid logs to a SIEM using syslog and create a correlation rule that triggers an alert on the malicious URL indicator.
   • DConfigure Squid to write logs to a file and have a cron job parse the logs every hour for malicious URL patterns.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security operations center (SOC) uses a SIEM to monitor network activity. They want to incorporate proxy logs to detect beaconing behavior (periodic outbound connections) from internal hosts. Which proxy log data and SIEM configuration would best support this detection?

   • AConfigure Squid to log only the URL and user agent, and use a SIEM to search for unusual user agents.
   • BUse HAProxy logs to record only the source IP and response time, and set up a SIEM rule to alert on high response times.
   • CEnable Squid access logs with timestamps and destination IPs, and create a SIEM correlation rule that counts connections per destination per time window.
   • DExport NetFlow data from the router to the SIEM and use that exclusively for beaconing detection.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A network administrator needs to load-balance inbound HTTPS traffic across three web servers while also terminating TLS and hiding the backend server IPs. Which open source proxy should be used?

   • ASOCKS proxy for external clients
   • BA transparent proxy on the internal network
   • CSquid configured as a forward proxy
   • DHAProxy configured as a reverse proxy with SSL termination
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   When deploying HAProxy as a reverse proxy, which configuration section is used to define the frontend that listens for incoming client connections?

   • Afrontend
   • Bbackend
   • Clisten
   • Dglobal
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst needs to visualize proxy traffic patterns to detect anomalies. They have a SIEM that can ingest JSON logs. Which approach best enables this analysis?

   • AStore logs in a database and use a custom dashboard
   • BEnable HAProxy's statistics report
   • CUse Squid's native log format and manually parse it
   • DConfigure Squid to log in JSON format and forward to the SIEM
   Reveal Solution Discussion Select an answer first