An analyst is investigating a potential data exfiltration incident. The Squid proxy logs show a large number of POST requests to a single external IP address from a specific workstation. The analyst needs to determine the volume of data uploaded and correlate the activity with other network events. Which approach provides the most complete evidence for this investigation?

Enable Squid's store_id_program to log the size of each cached object and calculate total upload size from cache hits.

Run tcpdump on the proxy server to capture all traffic to the external IP and analyze the pcap files manually.

Use the Squid access log to count the number of POST requests and their timestamps, then manually cross-reference with firewall logs.

Configure Squid to log the request body size using the %<st format code and feed the logs into a SIEM for correlation with NetFlow and DNS logs.

An organization uses HAProxy as a reverse proxy for its web application. The security team wants to feed HAProxy logs into their SIEM for real-time alerting on suspicious requests. What is the most effective way to achieve this?

Enable HAProxy's built-in web interface for log viewing

Store logs in a local file and manually review them

Configure HAProxy to send logs via syslog to the SIEM

Use HAProxy's health check reports as log data

An analyst notices that Squid logs show repeated requests to a URL with a long query string from a single internal IP. The analyst suspects data exfiltration. Which log field would provide the most direct evidence of the data being sent?

The full URL including the query string

A large enterprise is designing a security monitoring architecture. They need to inspect both inbound traffic to their public web servers and outbound traffic from internal users. They also need to ensure that the monitoring solution does not become a single point of failure. Which architecture best meets these requirements?

Deploy a single HAProxy instance in front of the web servers and a single Squid instance for outbound traffic, both connected to a central log collector.

Deploy HAProxy for outbound traffic and Squid for inbound traffic, with no redundancy.

Deploy two HAProxy instances in an active-passive pair for inbound traffic and two Squid instances in a cache peer arrangement for outbound traffic, all logging to a centralized SIEM.

Use a single transparent Squid proxy on the core switch to inspect all traffic in both directions.

GIAC Network Forensic Analyst

Domain 3Objective 1

Open Source Network Security Proxies GNFA Practice Questions (Page 7)

Part of the Security Controls and Monitoring domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–30 in this domain), expect 9–15 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

6concepts

Questions 31–35

31foundation · easy
Which Squid configuration directive is used to require authentication from clients before allowing them to use the proxy?
Select an answer first
32application · medium
An analyst is investigating a potential data exfiltration incident. The Squid proxy logs show a large number of POST requests to a single external IP address from a specific workstation. The analyst needs to determine the volume of data uploaded and correlate the activity with other network events. Which approach provides the most complete evidence for this investigation?
Select an answer first
33application · medium
An organization uses HAProxy as a reverse proxy for its web application. The security team wants to feed HAProxy logs into their SIEM for real-time alerting on suspicious requests. What is the most effective way to achieve this?
Select an answer first
34application · medium
An analyst notices that Squid logs show repeated requests to a URL with a long query string from a single internal IP. The analyst suspects data exfiltration. Which log field would provide the most direct evidence of the data being sent?
Select an answer first
35expert · hard
A large enterprise is designing a security monitoring architecture. They need to inspect both inbound traffic to their public web servers and outbound traffic from internal users. They also need to ensure that the monitoring solution does not become a single point of failure. Which architecture best meets these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.

Open Source Network Security Proxies GNFA Practice Questions (Page 7)

Questions 31–35

Which Squid configuration directive is used to require authentication from clients before allowing them to use the proxy?

An organization uses HAProxy as a reverse proxy for its web application. The security team wants to feed HAProxy logs into their SIEM for real-time alerting on suspicious requests. What is the most effective way to achieve this?

An analyst notices that Squid logs show repeated requests to a URL with a long query string from a single internal IP. The analyst suspects data exfiltration. Which log field would provide the most direct evidence of the data being sent?

Keep studying — Security Controls and Monitoring