A company wants to enforce a web usage policy that blocks access to known malware domains and restricts employees from using personal cloud storage services. The proxy must authenticate users so that violations can be attributed to specific individuals. Which Squid configuration approach meets these requirements?

Deploy HAProxy in front of the internet gateway with ACLs to block the domains and use client certificates for authentication.

Configure Squid as a transparent proxy with no authentication, relying on IP addresses to identify users.

Use iptables on the firewall to block the malware domains and cloud storage services at the network layer.

Use Squid's ACLs with dstdomain to block the malware domains and a regex ACL to block known cloud storage URLs, combined with proxy authentication via NTLM or LDAP.

An analyst is reviewing Squid logs to identify attempts to access a command-and-control (C2) server. The C2 domain is known but the IP address changes frequently. Which log field should the analyst use to ensure all attempts are captured?

The destination IP address field in the access log.

The source IP address field to identify the infected host.

The user agent field to identify the malware variant.

The destination domain field (if using SSL bump or explicit proxy) in the access log.

A security architect is designing a network to monitor both inbound and outbound traffic. They plan to use a reverse proxy for inbound web traffic and a forward proxy for outbound traffic. What is the primary security benefit of this dual-proxy architecture?

It provides separate choke points for inbound and outbound traffic, enabling tailored security controls and logging

It ensures all traffic is encrypted end-to-end

It eliminates the need for a firewall

It reduces the number of security devices needed

An organization uses HAProxy as a reverse proxy. The security team wants to detect SQL injection attempts in real time. They have a SIEM that can parse syslog. What is the most effective way to achieve this?

Configure HAProxy to log full HTTP requests to syslog and create SIEM rules to detect SQLi patterns

Store HAProxy logs in a file and review them weekly

Use HAProxy's health check logs to detect anomalies

Enable HAProxy's built-in WAF module

GIAC Network Forensic Analyst

Domain 3Objective 1

Open Source Network Security Proxies GNFA Practice Questions (Page 4)

Part of the Security Controls and Monitoring domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–30 in this domain), expect 9–15 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

6concepts

Questions 16–20

16application · medium
A company wants to enforce a web usage policy that blocks access to known malware domains and restricts employees from using personal cloud storage services. The proxy must authenticate users so that violations can be attributed to specific individuals. Which Squid configuration approach meets these requirements?
Select an answer first
17application · medium
An analyst is reviewing Squid logs to identify attempts to access a command-and-control (C2) server. The C2 domain is known but the IP address changes frequently. Which log field should the analyst use to ensure all attempts are captured?
Select an answer first
18expert · hard
A security architect is designing a network to monitor both inbound and outbound traffic. They plan to use a reverse proxy for inbound web traffic and a forward proxy for outbound traffic. What is the primary security benefit of this dual-proxy architecture?
Select an answer first
19foundation · easy
A security analyst is reviewing HAProxy logs to identify a client that received an HTTP 503 error. Which log field is most helpful for this analysis?
Select an answer first
20expert · hard
An organization uses HAProxy as a reverse proxy. The security team wants to detect SQL injection attempts in real time. They have a SIEM that can parse syslog. What is the most effective way to achieve this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.

Open Source Network Security Proxies GNFA Practice Questions (Page 4)

Questions 16–20

An analyst is reviewing Squid logs to identify attempts to access a command-and-control (C2) server. The C2 domain is known but the IP address changes frequently. Which log field should the analyst use to ensure all attempts are captured?

A security architect is designing a network to monitor both inbound and outbound traffic. They plan to use a reverse proxy for inbound web traffic and a forward proxy for outbound traffic. What is the primary security benefit of this dual-proxy architecture?

A security analyst is reviewing HAProxy logs to identify a client that received an HTTP 503 error. Which log field is most helpful for this analysis?

An organization uses HAProxy as a reverse proxy. The security team wants to detect SQL injection attempts in real time. They have a SIEM that can parse syslog. What is the most effective way to achieve this?

Keep studying — Security Controls and Monitoring