A forensic investigator needs to reconstruct the exact sequence of web requests made by a user during a security incident. The Squid proxy logs are available, but the user's workstation was behind a NAT that also served other users. The proxy uses no authentication. Which additional data source would most reliably attribute the requests to the specific user?

The workstation's local browser history and cache files.

The proxy's cache log, which records the internal IP of each request.

The NAT gateway's connection tracking logs, which map internal IPs and ports to external connections.

The DHCP server logs correlating IP addresses to MAC addresses and timestamps.

In a network security monitoring architecture, what is the primary role of a forward proxy?

To encrypt all traffic between clients and servers using TLS termination

To intercept and forward outbound client requests to external servers, allowing inspection and logging of user traffic

To transparently redirect traffic without requiring client configuration, but only for inbound traffic

To accept inbound connections from external clients and distribute them to internal backend servers

An organization must ensure that only authenticated users can use the corporate proxy. They have an existing LDAP directory. Which Squid configuration should be used?

Use IP-based ACLs to allow only certain subnets

Enable SSL bump to capture credentials

Configure Squid to use LDAP authentication via an external helper

Set up a reverse proxy with basic auth

A network administrator needs to generate a report of the top 10 most visited domains by internal users for a management review. The data is in the Squid access log. Which command-line tool or method is most efficient for this task?

Enable Squid's cache manager and use its built-in reporting feature.

Use awk to extract the destination domain field, sort, and count unique occurrences with uniq -c, then sort by count and take the top 10.

Open the log in a spreadsheet application and manually count the domains.

Use grep to search for each domain individually and count the lines.

A company wants to prevent users from uploading sensitive documents to personal webmail services. They use Squid as a forward proxy. Which Squid feature can be used to block these uploads while still allowing access to the webmail login page?

Use a dstdomain ACL to block the webmail domains entirely.

Use a time-based ACL to allow webmail only during lunch breaks.

Use the request_body_max_size directive to limit the size of POST requests to webmail domains.

Use a url_regex ACL to block POST requests to the webmail domains.

GIAC Network Forensic Analyst

Domain 3Objective 1

Open Source Network Security Proxies GNFA Practice Questions (Page 6)

Part of the Security Controls and Monitoring domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–30 in this domain), expect 9–15 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

6concepts

Questions 26–30

26expert · hard
A forensic investigator needs to reconstruct the exact sequence of web requests made by a user during a security incident. The Squid proxy logs are available, but the user's workstation was behind a NAT that also served other users. The proxy uses no authentication. Which additional data source would most reliably attribute the requests to the specific user?
Select an answer first
27foundation · easy
In a network security monitoring architecture, what is the primary role of a forward proxy?
Select an answer first
28application · medium
An organization must ensure that only authenticated users can use the corporate proxy. They have an existing LDAP directory. Which Squid configuration should be used?
Select an answer first
29application · medium
A network administrator needs to generate a report of the top 10 most visited domains by internal users for a management review. The data is in the Squid access log. Which command-line tool or method is most efficient for this task?
Select an answer first
30application · medium
A company wants to prevent users from uploading sensitive documents to personal webmail services. They use Squid as a forward proxy. Which Squid feature can be used to block these uploads while still allowing access to the webmail login page?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.